IT Glossary
A JSON Web Token (JWT) is a signed token carrying identity claims between systems. Learn its structure, its role in SSO, and its offboarding risk.
August 7, 2026
A JSON Web Token (JWT) is a compact, digitally signed token that carries identity claims between two systems without the receiver having to call back to the issuer. Defined in RFC 7519, it is the format used by OpenID Connect and by most modern APIs to prove who a user is and what that user is allowed to do.
A JWT is stateless. Once issued, it stays valid until it expires, even if the account behind it has already been disabled. If your access tokens live for one hour, a revoked employee can keep calling an API for up to an hour after deprovisioning. Short lifetimes combined with refresh token revocation are what turn an identity policy into an actual cut-off.
A finance team disables a departing controller in the identity provider at 09:00. The billing tool she was using issued a JWT at 08:50 with a 60-minute expiry, so her open session keeps working until 09:50. Nothing is broken here: this is how stateless tokens are designed to behave. The operational answer is to pair short token lifetimes with session revocation where the app supports it, and with a deprovisioning workflow that covers every application rather than only the federated ones. Corma automates that last part across the full SaaS estate.
Not by default. A standard JWT is signed with JWS, which guarantees integrity rather than confidentiality. Anyone with the token can decode the payload. Use JWE when the claims themselves must stay private.
A session cookie points to state held on the server. A JWT carries that state itself, so the server can validate it without a lookup, at the cost of being much harder to revoke before expiry.
Access tokens are commonly set between 5 and 60 minutes, paired with a longer-lived refresh token that can be revoked. Shorter lifetimes shrink the window after a user has been disabled.
OpenID Connect uses a JWT as its ID token. OAuth 2.0 access tokens are frequently JWTs as well, though the specification does not require that format.
