To authenticate users, we need to store something on the client that identifies the user. Often, this is implemented through a session ID, which is sent via the cookie header. JWT (pronounced jot) works similar—it is also a string that can be sent via a header (or through a URL or POST parameter). However, since JWT does not make use of cookies, it can be easily used across multiple domains.
JWT are JSON objects, which can be signed using a secret key pair (with the HMAC algorithm) or a public/private key pair using RSA. This signature ensures that the tokens do not get forged.
In addition to authentication, JWT also allows for information exchange. For example, we could store information on user roles (is the user an admin or not?) in the token. Since the tokens are signed, we can be sure that this information is correct. As a result, we do not need...
