In the modern era of web development, secure and efficient data exchange is a cornerstone of building robust applications. JSON Web Token (JWT) has become a widely adopted standard for securely transmitting information between parties. Its compact, self-contained, and stateless nature makes it a preferred choice for authentication and authorization in web applications, APIs, and microservices. But what exactly is JWT, and how does it work internally? Let’s explore its structure and internal mechanisms. <h2>What is JWT? </h2>​JWT (JSON Web Token) is an open standard (RFC 7519) that defines a compact and self-contained way to securely transmit information as a JSON object. It is primarily used for: <ol><li style="background-color: transparent">Authentication: Verifying the identity of a user or system.</li><li style="background-color: transparent">Authorization: Granting access to resources based on the user's identity.</li></ol>A JWT is essentially a string that consists of three parts: <ol><li style="background-color: transparent">Header</li><li style="background-color: transparent">Payload</li><li style="background-color: transparent">Signature</li></ol>These parts are separated by dots (<code>.</code>), forming a structure like this:<pre>eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c </pre>Let’s break down each part to understand how JWT works internally. <h3>1. Header</h3>The header contains metadata about the token, such as the type of token and the algorithm used for signing. It is a JSON object that is Base64Url-encoded. Example Header: <pre>{ "alg": "HS256", "typ": "JWT" } </pre>​<ul><li style="background-color: transparent">alg: Specifies the algorithm used to sign the token. Common algorithms include: <ul><li style="background-color: transparent">HS256 (HMAC with SHA-256)</li><li style="background-color: transparent">RS256 (RSA with SHA-256)</li></ul></li><li style="background-color: transparent">typ: Indicates the type of token, which is always JWT.</li></ul><pre>After Base64Url encoding, the header becomes: <code>eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9 </code> </pre><h3>2. Payload</h3>The payload contains the claims, which are statements about an entity (usually the user) and additional data. Claims are also represented as a JSON object and are Base64Url-encoded. Example Payload: <pre>{ "sub": "1234567890", "name": "John Doe", "iat": 1516239022 } </pre>​<ul><li style="background-color: transparent">sub: Subject of the token (e.g., user ID).</li><li style="background-color: transparent">name: Name of the user.</li><li style="background-color: transparent">iat: Issued At, which is the timestamp when the token was issued</li></ul>There are three types of claims: <ol><li style="background-color: transparent">Registered Claims: Predefined claims like <code>iss</code> (issuer), <code>exp</code> (expiration time), <code>sub</code> (subject), and <code>aud</code> (audience).</li><li style="background-color: transparent">Public Claims: Custom claims that are agreed upon by both parties.</li><li style="background-color: transparent">Private Claims: Custom claims used internally by the application.</li></ol> After Base64Url encoding, the payload becomes:<pre><code>eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ</code> </pre><h3>3. Signature</h3>​The signature is used to verify the authenticity of the token and ensure that it hasn’t been tampered with. It is created by taking the encoded header, the encoded payload, and a secret key, and then applying the specified algorithm. Formula for Generating the Signature: <blockquote>​HMACSHA256 ( base64UrlEncode(header) + "." + base64UrlEncode(payload), secret ) </blockquote> For example, if the secret key is <code>mysecretkey</code>, the signature might look like this:<pre><code>SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c</code> </pre><h2>Complete JWT </h2>​When we combine the encoded header, payload, and signature, separated by dots (<code>.</code>), we get the complete JWT:​ <pre>eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c </pre> <h2>How JWT Works Internally </h2>​<ul><li style="background-color: transparent">Token Creation: <ul><li style="background-color: transparent">The server generates a JWT after the user successfully authenticates.</li><li style="background-color: transparent">The header and payload are created as JSON objects, encoded using Base64Url, and signed with a secret key.</li></ul></li><li style="background-color: transparent">Token Transmission:<ul><li style="background-color: transparent">The JWT is sent to the client (e.g., browser or mobile app) and stored, typically in local storage, session storage, or a cookie.</li></ul></li><li style="background-color: transparent">Token Usage:<ul><li>The client includes the JWT in the <code>Authorization</code> header of HTTP requests to access protected resources:&nbsp;&nbsp;<code>Authorization: Bearer &lt;JWT&gt; </code></li></ul></li><li style="background-color: transparent">Token Verification:<ul><li style="background-color: transparent">The server receives the JWT and splits it into its three parts: header, payload, and signature.</li><li style="background-color: transparent">It verifies the signature using the secret key or public key (in case of asymmetric algorithms like RS256).</li><li style="background-color: transparent">If the signature is valid, the server trusts the claims in the payload and processes the request.</li></ul></li></ul> <blockquote>​A Bearer Token is a type of access token that is used in authentication and authorization systems to grant access to protected resources. The term "bearer" implies that whoever possesses the token (the "bearer") is authorized to access the associated resources. It is commonly used in modern web applications, APIs, and OAuth 2.0-based systems.​ </blockquote> <h2>Advantages of JWT</h2><ol><li style="background-color: transparent">Compact: The token is small and can be easily transmitted via URLs, headers, or cookies.</li><li style="background-color: transparent">Self-contained: All the information needed for authentication is included in the token, reducing the need for server-side storage.</li><li style="background-color: transparent">Secure: The signature ensures the integrity of the token, and sensitive data can be encrypted if needed.</li><li style="background-color: transparent">Stateless: JWTs enable stateless authentication, which is ideal for distributed systems and microservices.</li></ol> <h2>Limitations of JWT </h2><ol><li style="background-color: transparent">No Built-in Revocation: Once issued, a JWT cannot be revoked unless additional mechanisms like a blacklist are implemented.</li><li style="background-color: transparent">Size: JWTs can become large if the payload contains too much data.</li><li style="background-color: transparent">Expiration Management: Proper handling of token expiration is crucial to prevent unauthorized access.</li></ol><h2> </h2><h2>Best Practices for Using JWT </h2><ol><li style="background-color: transparent">Use Short Expiration Times: Set a short expiration time (<code>exp</code>) to minimize the risk of token misuse.</li><li style="background-color: transparent">Use HTTPS: Always transmit JWTs over HTTPS to prevent interception.</li><li style="background-color: transparent">Avoid Storing Sensitive Data: Do not store sensitive information (e.g., passwords) in the payload.</li><li style="background-color: transparent">Implement Token Revocation: Use a blacklist or other mechanisms to revoke tokens when necessary.</li><li style="background-color: transparent">Use Strong Secrets: Use a strong, random secret key for signing tokens.</li></ol>

Understanding the Internal Working Structure of JWT (JSON Web Token)

Internal Working Structure of JWT

​Artificial intelligence is no longer science fiction—it’s in our pockets, browsers, and daily workflows. As someone who’s spent months interacting with AI tools, I wanted to dive deep into one standout model:DeepSeek-R1. Here’s what makes this AI assistant unique and how it’s reshaping digital interactions.​​<h2></h2><h3 style="line-height: 1.5">What Is DeepSeek-R1?</h3>​Developed by the Chinese AI company DeepSeek, DeepSeek-R1 is a large language model (LLM) designed to be a versatile, ethical, and highly capable assistant. Unlike generic chatbots, it specializes in tasks requiringprecision(coding, math) andcreativity(writing, design), all while prioritizing user safety.<h2></h2><h3>Key Features of DeepSeek R1:</h3>Multimodal MasteryWhile text-based, DeepSeek-R1 can generate images through code (SVG, ASCII art), solve equations step-by-step, and even debug programming errors. Try asking it to“explain quantum physics using cooking metaphors”—you’ll see its knack for creative teaching. Ethical Guardrails The model refuses harmful requests and flags biased assumptions. For instance, if you ask for medical advice, it will redirect you to consult professionals—a critical safeguard in today’s AI landscape.Contextual Awareness During my tests, it remembered thread-specific details across long conversations, like adjusting code snippets iteratively or refining a story’s plot over multiple prompts.<h2 style="line-height: 1.5">Under the Hood: How It Works</h2>DeepSeek-R1 runs on atransformer architecture, trained on a vast corpus of:<ul><li>Academic papers (STEM, humanities)</li><li style="font-size: 18px">Licensed literature and code repositories</li><li style="font-size: 18px">Multilingual datasets</li></ul>What surprised me was itsdynamic resource allocation: complex queries trigger deeper neural network pathways, while simpler ones use optimized “fast lanes” for efficiency.<h2 style="line-height: 1.5">Real-World Use Cases</h2><ul><li>Students: It generates practice problems (with solutions) for topics like calculus or Python.</li><li style="font-size: 18px">Developers: Debugging assistance with line-by-line explanations.</li><li style="font-size: 18px">Writers: Brainstorming character arcs or translating idioms across languages.</li><li style="font-size: 18px">Curious Minds: Instant breakdowns of trending topics (e.g.,“Explain Web3 like I’m 10”).</li></ul><h2 style="line-height: 1.5">Limitations:</h2><ul><li>No Real-Time Data: It can’t fetch live sports scores or stock prices.</li><li style="font-size: 18px">Creative Boundaries: While it writes poetry, the output lacks human spontaneity.</li><li style="font-size: 18px">Memory Limits: Conversations reset after long threads, requiring users to recontextualize.</li></ul><h2> ​ </h2>

Inside DeepSeek-R1: Exploring the AI Assistant Changing How We Learn and Create

DeepSeek R1: Revolutionizing Data Retrieval and Insights

Exception handling in Java is a mechanism to handle runtime errors, allowing the normal flow of the application to be maintained. It involves using specific keywords like <code>try</code>, <code>catch</code>, <code>finally</code>, <code>throw</code>, and <code>throws</code>. Find Exception Class Heirarchy Below:<div class="se-component se-image-container __se__float-none" style="width: 100%"><figure style="width: 100%;"><img src="https://www.api.cstechie.com/upload/editor-image/exception-heirachy-class_1725307026648.png" alt="" data-rotate="" data-proportion="true" data-size="100%," data-align="none" data-percentage="100," data-file-name="exception-heirachy-class.png" data-file-size="81123" data-origin="," origin-size="901,591" style="width: 100%;"></figure></div><h2>1. Try-Catch Block</h2><ul><li><code>try</code> block: Code that might throw an exception is placed inside the <code>try</code> block.</li><li><code>catch</code> block: Handles the exception if one occurs. You can have multiple <code>catch</code> blocks to handle different types of exceptions.</li></ul><pre>try { int result = 10 / 0; // This will throw an ArithmeticException } catch (ArithmeticException e) { System.out.println("Cannot divide by zero!"); } </pre> <h2>2. Finally Block</h2><ul><li>The <code>finally</code> block is optional and is used to execute code that must run regardless of whether an exception was caught or not. It's often used for cleanup activities like closing files or releasing resources.</li></ul><pre>try { int result = 10 / 0; } catch (ArithmeticException e) { System.out.println("Cannot divide by zero!"); } finally { System.out.println("This will always be executed."); } </pre> <h2>3. Throw and Throws</h2><ul><li><code>throw</code> keyword: Used to explicitly throw an exception.</li><li><code>throws</code> keyword: Declares that a method may throw exceptions, indicating to the caller that they should handle or propagate the exception.</li></ul>Using throw:<pre>public void checkAge(int age) { if(age &lt; 18) { throw new ArithmeticException("Access denied - You must be at least 18 years old."); } else { System.out.println("Access granted - You are old enough!"); } } </pre>Using throws: <pre>public void myMethod() throws IOException { FileReader file = new FileReader("somefile.txt"); file.read(); } </pre> <h2>4. Custom Exceptions</h2>You can create your own exceptions by extending the <code>Exception</code> class.<pre>class MyCustomException extends Exception { public MyCustomException(String message) { super(message); } } public class Test { public void checkValue(int value) throws MyCustomException { if (value &lt; 0) { throw new MyCustomException("Value cannot be negative!"); } } }</pre> <h2>5. Best Practices</h2><ul><li style="font-size: 18px">Catch specific exceptions: Always try to catch the most specific exception first to ensure proper handling.</li><li style="font-size: 18px">Never swallow exceptions: Avoid empty <code>catch</code> blocks; they make debugging difficult.</li><li style="font-size: 18px">Use finally for cleanup: Ensure resources like files or connections are properly closed in the <code>finally</code> block.</li><li style="font-size: 18px">Custom exceptions: Use custom exceptions for more meaningful error handling in your application.</li></ul><h2> </h2><h2>6. Checked vs. Unchecked Exceptions</h2><ul><li>Checked Exceptions: These are exceptions that are checked at compile-time. Examples include <code>IOException</code>, <code>SQLException</code>, etc. You must either handle them using a <code>try-catch</code> block or declare them using <code>throws</code>.</li><li>Unchecked Exceptions: These are exceptions that occur at runtime and are not checked at compile-time. Examples include <code>ArithmeticException</code>, <code>NullPointerException</code>, etc. They are typically programming errors and do not need to be declared or caught. </li></ul><pre>//Example import java.io.*; public class ExceptionExample { public static void main(String[] args) { try { FileReader file = new FileReader("test.txt"); BufferedReader fileInput = new BufferedReader(file); // Print first 3 lines of file "test.txt" for (int counter = 0; counter &lt; 3; counter++) System.out.println(fileInput.readLine()); fileInput.close(); } catch (FileNotFoundException e) { System.out.println("File not found: " + e.getMessage()); } catch (IOException e) { System.out.println("I/O error occurred: " + e.getMessage()); } finally { System.out.println("This block is executed no matter what."); } } } </pre>In this example, <code>FileNotFoundException</code> and <code>IOException</code> are checked exceptions that must be either caught or declared in the method signature.

Exceptions In java and their Utilities with Examples

Exception Handling In Java

Java has seen significant updates and changes from Java 8 to Java 17. Below is a comparison of the key differences, new features, improvements, and deprecated features between Java 8 and Java 17. ​ <h2>Key Differences and New Features:</h2><h3>Java 8:</h3><ol><li style="font-size: 18px">Lambda Expressions: Introduced to enable functional programming, allowing you to pass functionality as arguments to methods.</li><li style="font-size: 18px">Stream API: Added to facilitate functional-style operations on streams of elements, such as map-reduce transformations on collections.</li><li style="font-size: 18px">Optional: A container object which may or may not contain a non-null value.</li><li style="font-size: 18px">Default Methods: Introduced in interfaces to provide default implementations for methods.</li><li style="font-size: 18px">Nashorn JavaScript Engine: A lightweight, high-performance JavaScript runtime.</li><li style="font-size: 18px">New Date and Time API: Improved date and time handling with the <code>java.time</code> package.</li><li style="font-size: 18px">Method References: Easier syntax for referring to methods.</li></ol><h3>Java 17:</h3><ol><li style="font-size: 18px">Sealed Classes: Allows classes to restrict which other classes or interfaces may extend or implement them.</li><li style="font-size: 18px">Pattern Matching for <code>instanceof</code>: Simplifies common instanceof checks.</li><li style="font-size: 18px">Records: A compact syntax for declaring classes which are transparent holders for shallowly immutable data.</li><li style="font-size: 18px">Text Blocks: Multiline strings, simplifying the inclusion of large text blocks in the code.</li><li style="font-size: 18px">Enhanced <code>switch</code>: <code>switch</code> expressions can now return values, and support for pattern matching.</li><li style="font-size: 18px">Foreign Function &amp; Memory API (Incubator): Provides an API to interact with native code and memory more safely and efficiently.</li><li style="font-size: 18px">Vector API (Incubator): Introduced to express vector computations that compile to optimal vector hardware instructions on supported CPU architectures.</li><li style="font-size: 18px">Deprecation and Removal of RMI Activation: The RMI Activation mechanism has been removed.</li><li style="font-size: 18px">Z Garbage Collector: A scalable low-latency garbage collector.</li><li style="font-size: 18px">Improved Docker Support: Better support for containerized environments, such as Docker.</li><li style="font-size: 18px">Numerous JEPs (JDK Enhancement Proposals): Each JEP brings in a range of new features and improvements.</li></ol>Deprecated and Removed Features <h3>Java 8:</h3><ul><li style="font-size: 18px">Java 8 itself was a major release and did not deprecate or remove many features, but it set the stage for future removals by introducing more robust APIs like the new Date and Time API.</li></ul><h3>Java 17:</h3><ul><li style="font-size: 18px">Removal of Nashorn: The Nashorn JavaScript engine, introduced in Java 8, has been removed.</li><li style="font-size: 18px">Removal of RMI Activation: The Remote Method Invocation (RMI) Activation has been deprecated and removed.</li><li style="font-size: 18px">Applets: Applets were deprecated in Java 9 and have been removed in Java 17.</li><li style="font-size: 18px">Finalization: Finalization has been deprecated for removal in a future release.</li></ul>Performance Improvements <ul><li style="font-size: 18px">Garbage Collection Enhancements: Java 17 includes improvements to the Z Garbage Collector (ZGC) and the Shenandoah GC, providing better performance and lower latency.</li><li style="font-size: 18px">JVM Improvements: The JVM continues to receive performance improvements, making newer versions generally faster and more efficient than older ones.</li></ul>Security Enhancements <ul><li style="font-size: 18px">Enhanced Security Algorithms: Java 17 includes more secure and efficient cryptographic algorithms.</li><li style="font-size: 18px">Improved Container Awareness: Better resource management and security in containerized environments like Docker.</li></ul>Compatibility and Migration <ul><li style="font-size: 18px">Backward Compatibility: Java strives to maintain backward compatibility, but migrating from Java 8 to Java 17 may require changes in the code, especially if deprecated features were used.</li><li style="font-size: 18px">Deprecation Warnings: Pay attention to deprecation warnings in Java 8, as these features may be removed in future versions.</li></ul>Conclusion Java 8 was a major release that introduced a range of features enabling functional programming and modern APIs, making it one of the most widely used versions of Java.Java 17 is the latest Long-Term Support (LTS) version, incorporating numerous new language features, API enhancements, and performance improvements, while also cleaning up older, less secure, or less efficient features.Upgrading from Java 8 to Java 17 offers many benefits in terms of performance, security, and language features. However, it requires careful consideration of code changes due to deprecated and removed features.

Comments

Blogs

Internal Working Structure of JWT

DeepSeek R1: Revolutionizing Data Retrieval and Insights

Exception Handling In Java

JAVA 8 VS JAVA 17