JSON Web Token (RFC 7519)

1. JWT overview

   JWT as a claims set carried in JWS or JWE.

2. JWT claims

   Registered claims iss, sub, aud, exp, nbf, iat, jti and custom claims.

3. JOSE header

   typ, cty, alg header parameters.

4. Creating and validating a JWT

   Steps for issuing and validating JWTs.

5. Unsecured JWTs

   alg none and why it must be rejected.

6. Implementation requirements

   Required and recommended algorithms.

7. Security considerations

   Trust, key confusion and signature stripping.

8. JWT best current practices

   Algorithm verification, issuer/audience validation and explicit typing.

Each section links to the official page. Titles and summaries by Extra Credit; the docs belong to their authors.