How Does JWT Authentication Work? (JSON Web Token) | Tokens vs Sessions

In this video you'll learn about how JWT Authentication works, and how token authentication differs from sessions.
Contact Me: [e-mail]
Github: github.com/nikitapryymak
Support Me: www.paypal.com/paypalme/nikit...
#jwt #jsonwebtoken #jwtauth

[@sydneyidundun9187]

Amazing content bro, keep at it already a fan and this is the first video I’ve watched.

[@tompryymak9469]

Great job! So helpful.

[@biokode]

I'm deep-diving into JWT to learn it completely. Started watching a lot of videos on it, and this one is VERY good! Need to play it on loop for some time I bet

[@1c72]

Absolutely wonderful clarity and quality ❤️

[@nikita-dev]

thank you!

[@SureshS-fv5co]

Very concise explanation of JWT tokens, Thanks!

[@imadhamdiazghough9015]

best explanation on yt, keept the good work my friend

[@priyasivakumar3607]

It’s Helpful. Thanks

[@deanelie7775]

Such a great explanation! thank you so much.

[@kirankumarrudraraju2429]

Excellent explanation and very easy to understand..thank you

[@pulserudeus7968]

awesome! this explanation is the best out there! thanks man! instant subscriber here 🔥

[@devidas90]

Nicely explained dude, keep it up 👍

[@hex9219]

that's cool, it all make sense right now. thanks man

[@evee4148]

Osm man keep doing like this....

[@Parhoom]

Excellent explanation. thank you!

[@asdfghjkl5418]

Perfect.

[@TheMudioc]

Hello ! Thank you for the refreshers ! Great video One question: what do you mean by creating a whitelist for refresh token ? If you use RT rotation, what's whitelisting adding to it ?

[@nikita-dev]

A whitelist would be an alternative to RT rotation-- you wouldn't use both

[@HossamQandeel]

Amazing ❤️🇪🇬

[@momobear66]

Can I use personal access token(PAT) as refresh token?

[@user-tp4fj2kf3p]

you mention that it validation is done using private-key. That seems odd; generally we should be able to verify the signature using the public key, can you please clarify?

[@nikita-dev]

There are various hashing algorithms that use different approaches to signing and verifying tokens. Some use just 1 private key (HS256), and some use both a public key and a private key (RS256). It just depends on the algorithm

[@mr.random8447]

Why not store JWT in secure httpOnly cookie instead, to prevent XSS on local storage?

[@nikita-dev]

that works as well 👍

[@emekarr]

I don’t think JWT authentication can work effectively without making some sort of db call with every request. For example to know which tokens have been invalidated when the user signs out