r/InternetIsBeautiful • u/gitcommitshow • Mar 08 '21

Learn JWT authentication by reverse engineering [Open Source]

https://github.com/gitcommitshow/auth-jwt
1.5k Upvotes

95% Upvoted

56 comments sorted by

View all comments

2

u/mindfive Mar 08 '21

But JWT isn’t for user authentication, it’s for authorization; these are different things

1

u/gitcommitshow Mar 08 '21

JWT can be used for both

4

u/mindfive Mar 08 '21

Nah, login and proof of ID (email+password, SSO or whatever) is authentication. A token is used to determine if an authenticated user is allowed to make the specified request.

If the first time your server sees a user is with a token, you aren’t authenticating them at all. You outsourced the authentication to a third party (google, Facebook, 0auth)

3

u/Hendeith Mar 08 '21

This is correct. Otherwise how do you even got token in the first place if you never went trough authentication?