JWT Tokens in C++: Implementation and Verification with jwt-cpp

JWT Tokens in C++: jwt-cpp Library

JSON Web Token (JWT) is a compact and self-contained way to transmit information between parties as a JSON object. In C++, there are several libraries for working with JWT, but one of the most popular and convenient is jwt-cpp. It provides a simple API for creating, signing, and verifying JWT tokens using various algorithms (HMAC, RSA, ECDSA).

In this article, we will explore the main features of the jwt-cpp library, learn how to create and verify tokens, and examine code examples for typical tasks.

Installing jwt-cpp

The jwt-cpp library is header-only, which simplifies its integration into a project. To install, simply clone the repository:

git clone https://github.com/Thalhammer/jwt-cpp.git

Then add the path to the include folder to your compiler settings. If you are using CMake, the connection will look like this:

add_subdirectory(jwt-cpp)target_link_libraries(your_project jwt-cpp)

The library depends on OpenSSL and jsoncpp (or nlohmann/json), so make sure they are installed.

Basic JWT Token Creation

The simplest example is creating a token using the HMAC-SHA256 algorithm. You can add standard fields (iss, sub, exp, iat) and custom claims to the token.

#include <jwt-cpp/jwt.h>#include <iostream>

int main() {    // Create a token    auto token = jwt::create()        .set_issuer("auth0")        .set_subject("1234567890")        .set_issued_at(std::chrono::system_clock::now())        .set_expires_at(std::chrono::system_clock::now() + std::chrono::hours{1})        .set_payload_claim("name", jwt::claim(std::string("John Doe")))        .sign(jwt::algorithm::hs256{"secret-key"});

    std::cout << "Token: " << token << std::endl;    return 0;}

The result will be a string consisting of three parts (header, payload, signature) separated by dots.

Token Verification

To verify the authenticity of a token, you must use the same secret key (or public key for RSA). Example of verification:

#include <jwt-cpp/jwt.h>#include <iostream>

int main() {    std::string token = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9..."; // your token

    try {        auto decoded = jwt::decode(token);                // Verify the signature        auto verifier = jwt::verify()            .allow_algorithm(jwt::algorithm::hs256{"secret-key"})            .with_issuer("auth0");

        verifier.verify(decoded);

        // Extract data        std::cout << "Token is valid!" << std::endl;        std::cout << "Subject: " << decoded.get_subject() << std::endl;        std::cout << "Name: " << decoded.get_payload_claim("name").as_string() << std::endl;    } catch (const std::exception& e) {        std::cerr << "Verification error: " << e.what() << std::endl;    }

    return 0;}

Important: if the token is expired (exp), modified, or signed with a different key, an exception will be thrown.

Working with RSA (Asymmetric Encryption)

For more secure systems, RSA is often used. In this case, the token is signed with a private key and verified with a public key.

#include <jwt-cpp/jwt.h>#include <fstream>#include <sstream>

int main() {    // Read the private key from a file    std::ifstream priv_file("private.pem");    std::stringstream priv_ss;    priv_ss << priv_file.rdbuf();    std::string private_key = priv_ss.str();

    // Create a token with RSA    auto token = jwt::create()        .set_issuer("myapp")        .set_subject("user123"