Registered claim names are reserved claim names that have special meanings. They are defined in the JWT specification and can be found on the Internet Assigned Numbers Authority (IANA) JSON Web Token Claims registry. Although these names are reserved and have a special meaning, the way the server processes these claims is completely up to the servers itself. All registered claims are optional:
- iss: Issuer: The principal that issued the JWT. In our case, this would be something like hobnob.
- sub: Subject: The entity that the claims apply to. In our case, this would be the user's email or ID.
- aud: Audience: A list of all principals that are intended to process the JWT. If the principal processing the claim does not identify itself with a value in the aud claim when this claim is present, then the JWT must be rejected.
- exp: Expiration Time: The time, in UNIX timestamp (seconds), on or after which the JWT must be considered as invalid. However, the server may provide some leniency (up to a few minutes) to account for cases where server clocks are not synchronized.
- nbf: Not Before: The time, in UNIX timestamp (seconds), before which the JWT must be considered invalid.
- iat: Issued At: The time, in UNIX timestamp (seconds), at which the JWT was issued.
- jti: JWT ID: A unique identifier for the JWT. It can be used to prevent replay attacks if the JWT is meant to be used as a nonce (that is, a one-time token). It can also be used to revoke tokens.
Claim names are short to minimize the overall size of the JWT, as a JWT needs to be included in every request that requires authentication/authorization.