wip

Author: clovis-akeneo

content/extensions/ui-extensions.md

@@ -197,13 +197,71 @@ To configure an `iframe` UI extension, mandatory fields are `name`, `position`,
 
 **Ensuring security of embedded iframes**
 
-- Properly configure [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) headers to control the sources from which content can be loaded.
+* Properly configure [Content Security Policy (CSP)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) headers to control the sources from which content can be loaded.
 
 ::: warning
  Please note that if these headers are misconfigured, iframe functionality may not work as intended.
 :::
 
-- Add a secret to you extension. It will be used to generate a JWT token that is sent to the iframe using post message.
+* Add a secret to your extension. This secret will be used to generate a JWT token when the iframe is loaded by the PIM system.
+
+**Receiving the JWT Token via ```postMessage```**
+
+Upon loading the iframe, the PIM will send a postMessage with the JWT token. The message will be structured as follows:
+
+```json
+{
+  "type": "JWT_TOKEN"
+  "token": "jwt_value"
+}
+```
+
+* The JWT token in the token field is generated using SHA256 encryption based on the secret you provided.
+
+For more information on how JWT tokens are structured and used, you can refer to the associated [RFC 7519](https://datatracker.ietf.org/doc/html/rfc7519).
+
+**JWT Token Structure**
+
+The JWT token consists of three main parts: the header, the body (payload), and the signature.
+
+*Header*
+
+* The header typically contains information about the token type and the signing algorithm. In this case, it will look like:
+
+```json
+{
+  "typ": "JWT",
+  "alg": "HS256"
+}
+```
+
+*Payload*
+
+* The payload contains the claims. The JWT token’s will look like this:
+
+```json
+{
+  "jti": "c1b6b9f1-8486-4f9e-9f96-8d1b40fccb65",
+  "iat": 1743410036.116152,
+  "exp": 1743413636.116162,
+  "userId": "1"
+}
+```
+
+* jti: The unique identifier for the token.
+* iat: The issued at time.
+* exp: The expiration time of the token.
+* userId: The PIM user identifier (in this case, 1).
+
+*A signature*
+
+* The signature is used to verify that the token is valid and has not been tampered with. It is generated by combining the encoded header and payload, and then signing them with the secret key. The resulting signature might look like:  
+```9WBB7ayP8UnFrOlMrI9NzTj3kxaiXOWJzElyacEKt48```
+
+**Verifying the Signature**
+
+To ensure that the JWT token was issued by Akeneo, you can verify the signature by re-encoding the header and payload and then signing them using the same secret key. This will allow you to confirm that the token is valid and has not been altered.
+
 
 **PostMessage**