Building Enterprise JavaScript Applications

Signature

Once we have a list of claims, or assertions, written inside the token, we must sign it. This is because anyone can create a token with those claims, or even tokens with different claims! We don't want to honor these tokens; we only want to honor tokens that are generated by our own servers (are authentic) and have not been tampered with (have integrity). We can do this by first attaching a JWS signature to the token, and then validating it when the token is processed.

A digital signature is different from a JWS signature, as a JWS signature may also include Message Authentication Codes (MACs). When talking about JWTs, the term "signature" or "signing a token" usually refers to a JWS signature, not specifically a digital signature. ...