Added notes around the JWT stuff

https://tools.ietf.org/html/rfc7519

How a JWT looks like , (base 64 encode)

(PART1)eyJhbGciOiJSUzI1NiIsImtpZCI6Ijc4YjRjZjIzNjU2ZGMzOTUzNjRmMWI2YzAyOTA3NjkxZjJjZGZmZTEifQ(PART2)eyJpc3MiOiJhY2NvdW50cy5nb29nbGUuY29tIiwic3ViIjoiMTEwNTAyMjUxMTU4OTIwMTQ3NzMyIiwiYXpwIjoiODI1MjQ5ODM1NjU5LXRlOHFnbDcwMWtnb25ub21ucDRzcXY3ZXJodTEyMTFzLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tIiwiZW1haWwiOiJwcmFiYXRoQHdzbzIuY29tIiwiYXRfaGFzaCI6InpmODZ2TnVsc0xCOGdGYXFSd2R6WWciLCJlbWFpbF92ZXJpZmllZCI6dHJ1ZSwiYXVkIjoiODI1MjQ5ODM1NjU5LXRlOHFnbDcwMWtnb25ub21ucDRzcXY3ZXJodTEyMTFzLmFwcHMuZ29vZ2xldXNlcmNvbnRlbnQuY29tIiwiaGQiOiJ3c28yLmNvbSIsImlhdCI6MTQwMTkwODI3MSwiZXhwIjoxNDAxOTEyMTcxfQ.(PART-3)TVKv-pdyvk2gW8sGsCbsnkqsrS0TH00xnY6ETkIfgIxfotvFn5IwKm3xyBMpy0FFe0Rb5Ht8AEJV6PdWyxz8rMgX2HROWqSo_RfEfUpBb4iOsq4W28KftW5H0IA44VmNZ6zU4YTqPSt4TPhyFC9fP2D_Hg7JQozpQRUfbWTJI

(PART-1) Algorithim and Token called as Javascript Object Signing and Encryption (JOSE)

{
“alg”: “RS256”,
“kid”: “78b4cf23656dc395364f1b6c02907691f2cdffe1”
}

(Part-2)Payload

{
“iss”: “accounts.google.com”,
“sub”: “110502251158920147732”,
“azp”: “825249835659-te8qgl701kgonnomnp4sqv7erhu1211s.apps.googleusercontent.com”,
“email”: “prabath@wso2.com”,
“at_hash”: “zf86vNulsLB8gFaqRwdzYg”,
“email_verified”: true,
“aud”: “825249835659-te8qgl701kgonnomnp4sqv7erhu1211s.apps.googleusercontent.com”,
“hd”: “wso2.com”,
“iat”: 1401908271,
“exp”: 1401912171
}

(PART-3)VERIFY SIGNATURE

RSASHA256( base64UrlEncode(header) + “.” + base64UrlEncode(payload),Public Key Or Certificate , or Private Key)
Reference https://medium.facilelogin.com/jwt-jws-and-jwe-for-not-so-dummies-b63310d201a3

• Web Technologies