<\/p>
After a user signs in, a session is securely created by the server. Then, that session ID is stored in a session cookie on the user\u2019s browser. While the user remains logged in, the cookie is sent with every subsequent request.
<\/p>
At each request, the server takes a look at the session cookie to read the session ID. If it matches the data stored in its memory, it sends a response back to the browser letting it know everything\u2019s okay and ready to go.
<\/p>
That\u2019s when the session is authenticated and the user is free to browse the password-protected page. When they click to another protected page, the process repeats.<\/p>
What are JSON Web Tokens?<\/h2>
JSON Web Token is often abbreviated to JWT and is commonly pronounced as \u201cjot.\u201d
<\/p>
A JSON web token takes JASON data, called a claim, and transfers it securely. It does this by cryptographically signing the claim. The signature is either symmetrically or asymmetrically signed, but both offer authentication.
<\/p>
This process is a form of token-based authentication.
<\/p>
JSON web tokens work in a similar way as a bank account number on a cheque, and the signature that\u2019s placed on it to approve the transfer of money with the cheque.
<\/p>
If you\u2019re renting an apartment and wanted to pay rent by cheque, your name attached to your bank account number is similar to a claim.
<\/p>
It\u2019s basic details about you that needs to be passed along if you want to pay your rent. It\u2019s similar to a claim because a claim would have a few details about you that\u2019s saved after you log in or otherwise have your identity authorized in order to visit password-protected pages.
<\/p>
You being able to use the website or app after logging in would be like paying your rent in this analogy.
<\/p>
The cheque would also include your signature. Your signature is specifically unique to you, and lets the bank know that you authorize the transaction. Because this signature is unique to you, the bank can be confident that you are who you say you are, and the transaction is able to go through.
<\/p>
Your signature on the cheque is like a JSON web token\u2019s cryptographic signature. In a JWT, this signature is able to authorize that it\u2019s definitely you wanting to access a site or an app.
<\/p>
But here\u2019s the kicker: What if your landlord or landlady didn\u2019t get your signed cheque with your bank account number and name? What if you paid rent by giving an envelope of cash with no other details?
<\/p>
Your landlord or landlady would get a building\u2019s worth of tenants all sending them envelopes of cash without any real way of being able to verify it\u2019s from you, or any of their tenants. Yikes! What a mess.
<\/p>
When you use JSON web tokens, it\u2019s like handing over a cheque to pay rent instead of an unmarked envelope of cash \u2013 your identity can be confidently authorized, and the process of paying rent can be completed.
<\/p>
With JSON web tokens, your identity is unequivocally verified, and you\u2019re able to continue browsing the website or app where you logged in.
<\/p>
It may also be important to note that a JSON web token consists of three main parts that are separated by periods: A header, payload, and signature.
<\/p>
![\"A](\"https:\/\/wp-rocket.me\/wp-content\/uploads\/1\/wp-rocket-json-web-token.png\")
<\/figure>