What they are, how they work, and why your app needs them
You log into an application. A few seconds later, you are in — and the app knows who you are, what you are allowed to do, and keeps knowing it for the rest of your session. But how? The server did not ask you to log in again on the next page. It did not look you up in a database on every click. Something is carrying your identity around, and in most modern applications, that something is a JWT token.
This article explains what JWT tokens are, what they contain, and why they have become the standard mechanism for authentication in modern applications.
The problem JWT tokens solve
Before tokens, the most common approach was server-side sessions. When you logged in, the server created a session record in memory or in a database, assigned it an ID, and sent that ID to your browser as a cookie. On every subsequent request, the browser sent the cookie back, the server looked up the session, found your user data, and proceeded.
