JWT Authentication Explained: A Token You Can Verify Without a Database
Ayesha manages a small online shop. Each morning she checks yesterday's paid orders and marks parcels ready to ship. Her dashboard talks to a small Node.js API, and every request has to answer one question first: is this really Ayesha? The usual answer is a session stored on the server, but that means a database lookup on every request, and it breaks when the API grows a second server. A JSON Web Token, a JWT, answers the same question without the lookup. The token carries who the caller is, and the server checks the token's signature instead of asking a database. This post builds that check with nothing but Node.js built-in crypto, and shows where it breaks if you use it carelessly. What I would check before using it My judgement, from building small APIs for years, is this: a JWT is the right call when several services need to check who is calling without sharing a database, and the wrong call when you need to cancel access instantly. The first check is revocation. A token ...
