JWT gồm 3 phần, separated by dots:
Header.Payload.Signature
eyJhbGciOiJSUzI1NiJ9.eyJzdWIiOiJ1c2VyLTEyMyJ9.signature
| Part | Nội dung |
|---|---|
| Header | Algorithm (RS256), token type (JWT) |
| Payload | Claims: sub, email, iss, exp, iat, custom claims |
| Signature | Verify token integrity |
1. Decode JWT (base64)
2. Verify signature (public key từ Cognito JWKS endpoint)
3. Check expiration (exp claim)
4. Check issuer (iss claim = Cognito User Pool URL)
5. Check audience (aud claim = App Client ID)
Client → API Gateway → Cognito Authorizer → Validate JWT
→ Extract claims
→ Allow/Deny
$context.authorizer.claimsAccess Token expired → Use Refresh Token → Cognito → New Access + ID Tokens
Exam Tip: JWT = stateless authentication. API Gateway Cognito Authorizer = simplest way to validate JWT. Không cần Lambda authorizer nếu chỉ dùng Cognito.