jwt

autherization:-

the same user or not it has access or not it normal done by session

cookies:-jwt (session id)

authentication process:--

you take username and password and check in for authentication

client:---server

and send session id as cookie

2nd time client:---server

send request with session id cookie:--get user from session

based on id and verify them and send response back to the client

2:----jwt:---

client :------server

send jwt to browser

2nd time:

send request with jwt :---server verify jwt

signature and get user from jwt:-----send response to client

nothing stores in user its in client browser .

https://jwt.io/

encode:

to and from the client how u authorize

decode:

header:algo and type it is in verify signature

payload:-information which u store as a token

sub:-its id of client

name:

iat:/eat:-exprire day

verify signature

takes header and payload

secret:----key stores in server no one can access(hashed)

bank:----retirement(two server)

client(browser) b/z both key by bank and retirement shared

how many server u have no mater

webservices api etc use jwt

Web Developer