Glossary

JWT

JWT (JSON Web Token) is a compact, self-contained token for transmitting information between parties as a signed JSON object. Unlike sessions, the server stores no state — all information lives in the token itself.

Structure

A JWT consists of three Base64-encoded parts separated by dots: header.payload.signature. The header specifies the signing algorithm. The payload contains claims — arbitrary data (user_id, roles, exp). The signature lets the server verify the token has not been tampered with.

When to use

Stateless APIs — the server needs no database to validate a request
Microservices — the token is verified independently in each service

Pitfalls

JWTs cannot be revoked before expiry without a blacklist. Store them in an httpOnly cookie, not localStorage — this protects against XSS. Set a short exp (15–60 min) and use refresh tokens.