How Does JWT Authentication Work? (JSON Web Token) | Tokens vs Sessions

In this video you'll learn about how JWT Authentication works, and how token authentication differs from sessions.
Github: github.com/nikitapryymak
Support Me: www.buymeacoffee.com/nikitadev
Contact Me: [e-mail]
#jwt #jsonwebtoken #jwtauth

[@sydneyidundun9187]

Amazing content bro, keep at it already a fan and this is the first video I’ve watched.

[@tompryymak9469]

Great job! So helpful.

[@biokode]

I'm deep-diving into JWT to learn it completely. Started watching a lot of videos on it, and this one is VERY good! Need to play it on loop for some time I bet

[@1c72]

Absolutely wonderful clarity and quality ❤️

[@nikita-dev]

thank you!

[@SureshS-fv5co]

Very concise explanation of JWT tokens, Thanks!

[@imadhamdiazghough9015]

best explanation on yt, keept the good work my friend

[@priyasivakumar3607]

It’s Helpful. Thanks

[@deanelie7775]

Such a great explanation! thank you so much.

[@eip408]

awesome! this explanation is the best out there! thanks man! instant subscriber here 🔥

[@kirankumarrudraraju2429]

Excellent explanation and very easy to understand..thank you

[@hex9219]

that's cool, it all make sense right now.
thanks man

[@devidas90]

Nicely explained dude, keep it up 👍

[@Parhoom]

Excellent explanation. thank you!

[@evee4148]

Osm man keep doing like this....

[@gauravjain969]

Thankyou very much.

[@HossamQandeel]

Amazing ❤️🇪🇬

[@asdfghjkl5418]

Perfect.

[@TheMudioc]

Hello !
Thank you for the refreshers ! Great video
One question: what do you mean by creating a whitelist for refresh token ? If you use RT rotation, what's whitelisting adding to it ?

[@nikita-dev]

A whitelist would be an alternative to RT rotation-- you wouldn't use both

[@momobear66]

Can I use personal access token(PAT) as refresh token?

[@mr.random8447]

Why not store JWT in secure httpOnly cookie instead, to prevent XSS on local storage?

[@nikita-dev]

that works as well 👍

[@user-tp4fj2kf3p]

you mention that it validation is done using private-key. That seems odd; generally we should be able to verify the signature using the public key, can you please clarify?

[@nikita-dev]

There are various hashing algorithms that use different approaches to signing and verifying tokens. Some use just 1 private key (HS256), and some use both a public key and a private key (RS256). It just depends on the algorithm

[@emekarr]

I don’t think JWT authentication can work effectively without making some sort of db call with every request. For example to know which tokens have been invalidated when the user signs out