JWT - MacKittipat/note-developer GitHub Wiki

Advantage

  • Stateless. Server don't have to store token.
  • Performance.
    • No database lookup for checking token validity.
    • JWT can store all information client need in payload such as user info, no round trip to server to get this info.
    • Client or Resource server can validate token if they has secret key. No round trip to Authorization server to check token validity.

Disadvantage

  • Once token is created, it cannot be invalidate because token is not stored on the server. Need to set proper expire time.

Best practices

  • Always store JWTs inside an HttpOnly cookie. This is a special kind of cookie that’s only sent in HTTP requests to the server. It’s never accessible (both for reading and writing) from JavaScript running in the browser.

JWT Signature and Verification