Implementing JWT Authentication

Anyone who holds a JSON Web Token can read what is inside it. Here is a token that the bookstore API issued when the user maria logged in:

eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxIiwidXNlcm5hbWUiOiJtYXJpYSIsImlhdCI6MTc5MzkxODIzNSwiZXhwIjoxNzkzOTE5MTM1fQ.RgRAeWqKgCxwyBBHq7xl4RLYqhrqxS8nehhIZQ2v940

The two periods split it into three parts. The first two parts are only base64url-encoded JSON, a way of writing bytes with URL-safe characters, and two lines of Node.js turn them back into text without any key:

const [header, payload] = token.split('.');