Exam 350-401 topic 1 question 427 discussion

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. references: https://jwt.io/introduction/

I'm still new to APIs and programming, but if I know cisco, they are about answering what is asked, and they hold your feet to the fires of semantics. This question is asking what JWT is in the context of REST APIs, and based on some sources, it specifically talks about authentication. While C is correct in the what JWT's purpose is, D is answering the question asked. https://blog.logrocket.com/secure-rest-api-jwt-authentication/

What is JWT (JSON Web Token)? JWT is an encoded, compact, and self-contained format for securely transmitting information between parties as a JSON object. The information within a JWT is digitally signed using a secret key or a public/private key pair. This ensures that the token's data cannot be tampered with.

Makes sense C due the question #651

D makes more sense. the question asking about the usage of JWT with REST API, not the usage of JWT in general

In the context of REST API security, while both options C and D describe valid uses of JWTs, the most precise and commonly accepted answer is D JWTs are encoded and signed tokens that are primarily used for authentication purposes in REST APIs. They allow servers to verify the identity of clients making requests. While JWTs can indeed be used to securely exchange information (as mentioned in option C), the primary and most specific use case in REST API security is authentication. Option D directly addresses the primary role of JWTs in the context of authentication, which is a fundamental aspect of securing REST APIs.

JSON Web Tokens (JWTs) are a compact and self-contained way to transmit information between parties as a JSON object. *They are commonly used for authentication purposes in REST APIs. A JWT contains claims or pieces of information encoded in a JSON format, which are digitally signed to ensure their integrity. This token is typically sent with each API request to verify the user's authenticity and access rights, allowing secure authentication and authorization within the API ecosystem. D. an encoded JSON token that is used for authentication.

In the context of REST API security, JWTs are often used for: -Authentication: Verifying the identity of the user. -Authorization: Determining what actions the authenticated user is allowed to perform. It's important to note that while JWTs can be a powerful tool for securing REST APIs, they should be used with care, and best practices for security, such as proper key management and token validation, should be followed to mitigate potential vulnerabilities.

ChatGPT: D. an encoded JSON token that is used for authentication JWT (JSON Web Token) is commonly used for authentication in REST API security. It is an encoded token that contains user or system information, and it is used to verify the identity of a user or system when making requests to an API.

A JSON web token(JWT) is JSON Object which is used to securely transfer information over the web(between two parties). It can be used for an authentication system and can also be used for information exchange. The token is mainly composed of header, payload, signature. These three parts are separated by dots(.)

Challenging semantics, but the reference to #651 below tells me it is C.

the correct answer is C. JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object

Answer is C REST API is a creation of data transmission, Although JWT is created for authentication purposes, the question simply ask what is the definition of JWT in regards to REST API.

You could argue that answer C is partially correct, as JWTs can be used to securely exchange information between parties. However, in the context of REST API security, the primary use case of JWTs is for authentication, not for exchanging information. JWTs are commonly used to transmit authentication information between a client and a server, allowing the client to prove its identity to the server. The server generates a JWT that includes a set of claims about the authenticated user, such as their ID or roles, and sends this token back to the client. The client can then include the JWT in subsequent requests to the server to prove its identity. While a JWT can include additional information beyond just authentication claims, its primary purpose in the context of REST API security is for authentication. Therefore, answer D ("an encoded JSON token that is used for authentication") is the most accurate answer to the question.

In regards to REST APIs https://blog.logrocket.com/secure-rest-api-jwt-authentication/

JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed.

JWT is in no way shape of form encrypted. It is used to Authenticate which is more secure, but really it's used to authenticate.