JWT withvreal time scenario

It has several advantages and is considered as secured one.

 

Advantages of JWT

It is compact – Can be sent via URL/ Post request/HTTP Header which makes it fast for transmission and usable.

Self Content – It contains the details of user (not session id in cookies like traditional request), so no need to query database to get user details.

Digitally signed – Information is verified and trusted.

Transfer information between two bodies. Bodies means user, sever etc./user, sever etc. is meant by Bodies.

Can be used in most of the programming languages as it can be mapped directly to the object.

JWTs can be signed using a secret (with the HMAC algorithm) or a public/private key pair using RSA or ECDSA.

 

JWT tokens are “stateless”, meaning that session information is not stored server-side. On top of the great gain in terms of saved memory on the server, JWT tokens can be used to authenticate users on multiple applications. To do that, the different applications will need to share the same private key to sign and verify tokens. Users will therefore be able to authenticate one single time on the application that manages user accounts, and to seamlessly use other applications that use the same private key, to verify the tokens’ validity. 

There is a huge advantage.

Think of it like this, 

Suppose you went to a hotel with your car, then which key do you give to the valet guy to park the car? The Master key or the valet key? Ofcourse the valet key is handed to the parking "valet" to park your car. 

 Beacuse Valet key would unlock the drivers door and start the car, but it would not open the trunk or the glove box allowing you to keep items secure.

 

Now come to programing world, suppose you want to give user the functionality to login through google or facebook, as google or facebook already has all the information about the user, if the user logins to facebook to reach to your app, you also grant him the permission to access your app. but how? Did facebook gave you the user's password too? No, facebook only gave you the little information like his name, profile pic etc but not the password.

And in which mode? in terms of token, facebook Authentication server created a token , stored minimal user information to that token and gave it to you.

Now, you analyzed the token given by FB, did some checks against your database, and grant the user, the permission to access your site.

 

So, token concept is usually used when you want to give minimal information to another party, so that the other party can use your authentication logic to authenticate his users, this reduces the time. The other party don't need to write logic to authenticate users, they just use your mechanism.

 

so, when we create API, we use token authentication, so that if any client like an MVC app, or a Java app, or an Angular app, tries to consume our API, on behalf of a registered user, then we give him the token with minimal information about the user and then these client access our api on behalf of that user.

 

JWT is just a readymade way of implementing token based authorization where you can pass userId and Password of any user and the app in return will give you the token (valet key).