JSON Web Token (JWT) : Authorization vs Authentication

Question

JWT terminology has been bothering me for a few reasons. Is JWT suitable for Authorization or is it only for Authentication?

Correct me if I'm wrong but I have always read Authorization as being the act of allowing someone access to a resource yet JWT doesn't seem to have any implementation that actually allows access to users to a given resource. All JWT implementations talk about is providing a user a token. This token is then passed with every call to a back-end service endpoint where it is checked for validity and if valid access is granted. So we can use JWT for Authentication of any user but how can we restrict the access to particular valid users ?

How can we use JWT for restricting a few users depending on roles they have? Do JWT provide any type of Authorization details as well or does it just provide us Authentication ?

Thanks in advance for your help and reading my doubt patiently.

Answer 1

Authorization with JWT can be achieved using the token specific claims.

As many other user information packaged as claims in the Json Web Token the specific permissions can be pre-filled in the token and can be intercepted later on by an authorization service.

Typically the authorization would be permission based where permissions are used to restrict access to an api endpoint (may also be used to grant users access to views on the frontend apps).

Here down a sample JWT token having a permission element:

{   "UserInfo": {     "id": "#{USER_ID}",     "roles": {       "#{ROLE_NAME}": "#{ROLE_ID}"     },     "permissions": {       "#{PERMISSION_NAME}": "#{PERMISSION_ID}",     }   },   "exp": 1488888888 }