How Modern Authentication (JWT – OAuth) works in practice

Quick summary

How Modern Authentication Works in Practice (JWT – OAuth) In modern web and mobile development, authentication is no longer just a simple username and password login. Today, systems rely on advanced standards like JWT (JSON Web Token) and OAuth 2.0 to improve security, scalability, and user experience. This article explains both concepts in a practical and simple way. ⸻ 1. What is Authentication? Authentication is the process of verifying a user’s identity. Simple example: * User enters email and password * System verifies the credentials * User is granted access However, modern systems need: * Persistent login sessions * Secure API communication * Cross-device access This is why JWT and OAuth are used. ⸻ 1. JWT (JSON Web Token) What is JWT? JWT is a token-based authentication system used to confirm a user’s identity after login. Instead of storing sessions on the server, the server issues a token that is sent with every request. ⸻ Structure of JWT A JWT consists of three parts: * Header * Payload * Signature They are combined like this: Header.Payload.Signature 1. Header Contains metadata about the token: { "alg": "HS256", "typ": "JWT" } 1. Payload Contains user information: { "userId": 123, "role": "admin", "exp": 1710000000 } ⚠️ Important: This data is not encrypted, only encoded. ⸻ 1. Signature A secure hash created using a secret key to ensure the token is not modified. ⸻ How JWT Works (Step-by-Step) 1. User logs in with email and password 2. Server verifies credentials 3. Server generates a JWT 4. JWT is sent to the client 5. Client stores the token 6. Token is sent with every request: Authorization: Bearer TOKEN 7. Server verifies the token and allows access ⸻ Advantages of JWT * Stateless (no server session storage) * Fast and scalable * Works well with APIs and mobile apps * Easy to implement ⸻ Disadvantages of JWT * Cannot be easily revoked * If stolen, it remains valid until expiration * Requires secure storage ⸻ 3. OAuth 2.0 What is OAuth? OAuth is an authorization framework that allows users to log in using third-party services like Google or Facebook without sharing their password. ⸻ Example * Login with Google * Login with Facebook This is OAuth. ⸻ How OAuth Works (Step-by-Step) 1. User clicks “Login with Google” 2. User is redirected to Google 3. User logs in 4. Google asks for permission 5. User approves access 6. Google sends an Authorization Code 7. Application exchanges it for an Access Token 8. Access Token is used to access data ⸻ Access Token vs Refresh Token * Access Token: short-lived, used for API requests * Refresh Token: long-lived, used to generate new access tokens ⸻ Advantages of OAuth * High security (no password sharing) * Easy login experience * Widely supported (Google, Facebook, GitHub) * Works across platforms ⸻ Disadvantages of OAuth * More complex than JWT * Requires external provider setup * More steps in implementation ⸻ 4. JWT vs OAuth (Corrected Table) JWT vs OAuth: JWT: * Authentication mechanism * Used to verify user identity inside the system * Does not involve sharing password after login * Data stored inside the token (payload) * Simple and fast * Commonly used for APIs and backend authentication OAuth: * Authorization framework * Used for login via external providers (Google, Facebook) * Password is never shared with the application * Data is managed by external provider * More secure but more complex * Commonly used for social login systems ⸻ 5. How JWT and OAuth Work Together In modern systems, they are often combined: * OAuth handles external login (Google, Facebook) * After login, the system generates a JWT * JWT is then used for internal API requests ⸻ Real Example E-commerce application: 1. User logs in with Google (OAuth) 2. System receives user data 3. Server generates a JWT 4. JWT is used for: * Cart operations * Orders * Profile access ⸻ 6. Best Practices * Always use HTTPS * Store JWT in HttpOnly cookies when possible * Set expiration time for tokens * Use refresh tokens for long sessions * Never store sensitive data in JWT ⸻ Conclusion * JWT is used for handling authentication inside applications using tokens * OAuth is used for secure login via external providers * Modern systems often combine both for better security and flexibility