JSON Web Tokens (JWT)

A signed JSON payload. The server signs it; the client stores it in a cookie; the server verifies the signature on every request.

Code example

# login
payload = {'sub': user.id, 'exp': now + 3600}
token = jwt.encode(payload, SECRET_KEY, 'HS256')
response.set_cookie('access_token', token, httponly=True)

# every request
payload = jwt.decode(token, SECRET_KEY, ['HS256'])
user_id = payload['sub']

How it works

A JWT is a JSON payload (user id, expiry, etc.) signed with a secret key. The signature proves the token wasn't tampered with. The flow: on login, the server creates a JWT and sets it as an httpOnly cookie (so JS can't read it). On every subsequent request, the server reads the cookie, verifies the signature, and extracts the user id. If the signature is invalid or the token has expired, the user is treated as logged out. OpenBenchML uses python-jose for encode/decode.