Token-based authentication is simpler. There are a few implementations of tokens, however, JSON Web Tokens is the most common one. Token-based authentication is stateless. That means no session is persisted on the server side because the state is stored inside the token on the client side. The responsibility of the server is only to create a JWT with a secret and send it to the client. The client stores the JWT in local storage, or a client-side cookie, and includes it in the header whenever making a request. The server then validates the JWT and sends a response.

But what is a JWT and how does it work? Let's find out in the next section.

What are JSON Web Tokens?

To understand how a JWT works, we should understand what it is first. In short, a JWT is a string of a hashed JSON object composed of a header, a payload, and a signature. A JWT is generated with the following format:

header.payload.signature

The header typically consists of two...