JSON Web Token (JWT) Authentication in Python

A guide on how to implement JSON Web Token (JWT) authentication in Python. This article covers how to generate and verify JWTs in a web application to secure APIs.

JSON Web Token (JWT) is an open standard for securely transmitting information between parties as a JSON object. In this article, you'll learn how to generate, encode, and decode JWT using Python and how to use it for API authentication in web applications.

Python Code

import jwt  # PyJWT library
import datetime

# Secret key for encoding and decoding JWT
SECRET_KEY = 'your_secret_key'

# Generate JWT
def create_jwt(user_id):
    # Create payload with user info and expiration time
    payload = {
        'user_id': user_id,
        'exp': datetime.datetime.utcnow() + datetime.timedelta(minutes=30)
    }
    
    # Encode the token
    token = jwt.encode(payload, SECRET_KEY, algorithm='HS256')
    return token

# Decode JWT
def decode_jwt(token):
    try:
        # Decode the token and return the payload
        payload = jwt.decode(token, SECRET_KEY, algorithms=['HS256'])
        return payload
    except jwt.ExpiredSignatureError:
        return 'Token has expired'
    except jwt.InvalidTokenError:
        return 'Invalid token'

# Example usage
if __name__ == "__main__":
    token = create_jwt(123)
    print(f'Token: {token}')
    
    decoded_payload = decode_jwt(token)
    print(f'Payload: {decoded_payload}')

Detailed explanation:

1. import jwt: Import the PyJWT library to work with JSON Web Tokens.
2. SECRET_KEY = 'your_secret_key': Define the secret key to encode and decode JWTs.
3. def create_jwt(user_id): Function to create a JWT with user_id and a 30-minute expiration time.
4. payload = {...}: Defines the payload containing user information and expiration time.
5. jwt.encode(...): Encodes the payload into a JWT using the HS256 algorithm.
6. def decode_jwt(token): Function to decode the JWT and check its validity.
7. jwt.decode(...): Decodes the token and returns the payload.
8. if __name__ == "__main__":: Example usage to demonstrate creating and decoding JWTs.

System requirements:

• Python 3.x
• PyJWT library (can be installed using pip install pyjwt)

How to install the libraries needed to run the Python code above:

pip install pyjwt

Tips:

• Avoid using weak or default secret keys, generate a strong key for security.
• JWT authentication is commonly used in secure APIs; be mindful of security aspects like token expiration and the strength of the secret key.

---