What is the use of JWT token ?

Hello Mohammed,

JWT is just a popular JSON based format of a security token.

JWT tokens are not invented to replace session cookies. They are mostly used to secure web APIs (request data). Session cookies on the other hand are used in web applications, where you log in a user and automatically send the cookies with each request (request pages). JWT tokens are included in the Authorization HTTP header as part of the bearer authentication scheme. The main advantages of using bearer scheme authentication is that it's not vulnerable to CSRF attacks because your script needs to explicitly attach the token to the request and can be used cross-domain (unlike cookies). Bearer scheme authentication does require HTTPS connections as anyone who manages to steal the token can use it to access the API for as long as the token is valid. Security protocols like OAuth2 use JWT tokens to secure APIs. OpenID Connect uses JWT tokens to authenticate web applications, but stores the token in a cookie. Since JWT tokens are digitally signed by the issuer (server doing the authentication), they can be validated without talking to the server again. Digital signatures allow you to sign a piece of data (JWT token in this case) with a private key and the server receiving the token only needs the public key to verify that none of the data was changed. So the API server only needs the public key (which is not secret) from an authorization server to trust tokens it issues. The client of the API brings the token and the API server can verify it without talking to the authorization server.

2 Replies

Know the answer? Post it — somebody with the same question will find it here.

Jaimin Shethiya6y ago
Accepted answer
Hello Mohammed,

JWT means Json Web Token.
and that is used for validate the API request and if token is validate then the API can return the actual result they have to requested.

JWT is provided that token is sometime after expire and again the generate that token and used to the API request.

Thanks
Rajanikant Hawaldar6y ago
Hello Mohammed,
JWT is just a popular JSON based format of a security token.
JWT tokens are not invented to replace session cookies. They are mostly used to secure web APIs (request data). Session cookies on the other hand are used in web applications, where you log in a user and automatically send the cookies with each request (request pages). JWT tokens are included in the Authorization HTTP header as part of the bearer authentication scheme. The main advantages of using bearer scheme authentication is that it's not vulnerable to CSRF attacks because your script needs to explicitly attach the token to the request and can be used cross-domain (unlike cookies). Bearer scheme authentication does require HTTPS connections as anyone who manages to steal the token can use it to access the API for as long as the token is valid. Security protocols like OAuth2 use JWT tokens to secure APIs. OpenID Connect uses JWT tokens to authenticate web applications, but stores the token in a cookie. Since JWT tokens are digitally signed by the issuer (server doing the authentication), they can be validated without talking to the server again. Digital signatures allow you to sign a piece of data (JWT token in this case) with a private key and the server receiving the token only needs the public key to verify that none of the data was changed. So the API server only needs the public key (which is not secret) from an authorization server to trust tokens it issues. The client of the API brings the token and the API server can verify it without talking to the authorization server.