How is angular-jwt decoding my JWT without a secret?

Question

The Auth0 team created something called "angular-jwt" which has a jwtHelper class. This thing successfully decodes a local JWT without the secret I used on the server. How did this happen? If they are not secure, then what is the point of using a secret to sign/encrypt them?

Function on the server that encrypts the token (using "jsonwebtoken"):

function createToken (user) {
    return jwt.sign(_.omit(user, 'password'), config.secret, { expiresInMinutes: 60*5 });
}

Code from the client:

angular
    .module('sample.home', [
        'ui.router',
        'angular-storage',
        'angular-jwt'
    ])
    .config(function ($stateProvider) {
        $stateProvider
            .state('home', {
                url: '/',
                controller: 'HomeCtrl',
                templateUrl: 'modules/home/home.html',
                data: { requiresLogin: true }
            })
    })
    .controller('HomeCtrl', function homeController ($scope, $http, store, jwtHelper) {

        $scope.jwt = store.get('jwt');
        $scope.decodedJwt = $scope.jwt && jwtHelper.decodeToken($scope.jwt);

    });

Here's a link to the full example: http://github.com/auth0/ang...

Answer 1

A JWT uses encoding, not encryption. The data that the token contains is not a secret, anyone can decode it and view. What the server does, is it signs the token using a secret (in your case, config.secret), which effectively makes it impossible to modify the token without knowing the secret. Hence, only the server will be able to change the contents of the token, but anyone can read it.