JSON Web Tokens are widely used for authentication.

They're also widely misunderstood.

A JWT is not automatically more secure than sessions.

It is simply a token format with specific properties.

Basic JWT Structure

A JWT commonly consists of three sections:

Header.Payload.Signature

Enter fullscreen mode

Exit fullscreen mode

For example:

xxxxx.yyyyy.zzzzz

Enter fullscreen mode

Exit fullscreen mode

The payload can contain claims:

{ "sub" : "12345" , "role" : "user" }

Enter fullscreen mode

Exit fullscreen mode

Important: JWT Payloads Are Not Secret

JWT contents are typically encoded, not encrypted.

Therefore, don't place sensitive information inside them.

For example, avoid putting:

{ "password" : "secret123" }

Enter fullscreen mode

Exit fullscreen mode

in a JWT.

Authentication Flow

A common flow is:

User logs in ↓ Server validates credentials ↓ Server issues token ↓ Client sends token with requests ↓ Server validates token

Enter fullscreen mode

Exit fullscreen mode

Token…