Working with JWT (JSON Web Tokens) in Automation

Availability: Release 6.0

JSON Web Tokens (JWTs) are a way to securely transmit information between parties, especially in web applications. They are commonly used for authentication (proving that you are who you say you are) and authorization (allowing you to access certain resources or perform certain actions).

JWTs are often sent in an HTTP header or as a URL parameter. When a user logs in to a web application, the server generates a JWT and sends it back to the client (usually a web browser). The client can then use the JWT to authenticate subsequent requests to the server. The server can also use information in the JWT to authorize the user to perform certain actions.

A JWT consists of three parts: a header, a payload, and a signature. The header identifies the type of token and the algorithm used to create the signature. The payload contains claims about the user or other information, such as their name or email address. The signature is used to verify that the sender of the JWT is who they say they are and to make sure the message hasn't been changed along the way.

ACCELQ provides support for building automation test logic involving JSON Web Tokens (JWT). You can generate tokens with various configurations to suit your testing needs. ACCELQ offers a range of options to generate these tokens, which can be particularly useful for testing server authentication.

Create JWT Token

This command creates a new JWT (JSON Web Token) with the given header and payload. You can also specify an expiration date/time for the token or sign it with a secret key if needed.

header

payload

expiration date time

date time format



custom date format



signing required


key type




key



private key path


private key format



algorithm

The header of the JWT, in JSON format.

The payload of the JWT, in JSON format.

The expiration date time for the token. This is optional.

The format for the expiration date time parameter. You can choose
from a list of predefined formats, or use a custom format.
The default value is "MM/dd/yyyy".

The custom format for the expiration date time parameter. 
This is required if the date time format is set to "custom".
This shoud be specified in standard Java DateTime format.

A flag indicating whether the token should be signed. 
Possible values are "yes" and "no". The default value is "no".

The type of key to be used for signing the token. This is required
if signing required is set to "yes". Possible values are
"Private Key", "Auto-Generated Key", "Base64-encoded Key",
"Base64URL-encoded Key" and "Raw Key".

The key to be used for signing the token. This is required
if key type is set to "Base64-encoded Key", "Base64URL-encoded Key"
or "Raw Key".

The path to the private key file to be used for signing the token.
This is required if key type is set to "Private Key".

The format of the private key file. Possible values are
"DiffieHellman", "DSA", "RSA", "RSASSA-PSS", and "EC". The default
value is "RSA". This is required if key type is set to "Private Key".

The algorithm to be used for signing the token. This is required if
signing required is set to "yes". Possible values are "HS256", "HS384",
"HS512", "RS256", "RS384", "RS512", "ES256", "ES384", "ES512", "PS256",
"PS384" and "PS512".

Get Key used for JWT Token

This command allows you to retrieve the key used for signing a JWT token. This can be useful in cases where you need to verify the authenticity of the token, or if you want to know which key was used to sign it.

key type






token

The type of key to return. It can be one of the following values:
 - Private Key: private key used for signing the token
 - Public Key: public key used for verifying the token
 - Secret Key: secret key used for signing and verifying the token

The default value is Private Key.

Represents the JSON Web Token (JWT), returned from token creation command.

Example

The following logic generates a JWT token with some custom headers and payload. Further the token is set to expire at a certain date and is signed with a private key. The next step retrieves the key used for signing the token. This is useful in certain places.