"We use JWT for authentication." You will hear this everywhere. It's a little wrong, and the confusion causes real bugs.
JWT is not authentication. Let me explain what it actually is. 🧵
SpringSecurity - Day 23
Recap:
JWT is a signed data format, not a login.
You authenticate first (username + password).
Then a JWT carries that proof on every later request. Verify every token. Never trust one blindly.
Next: what's actually inside a JWT.
"We use JWT for authentication." You will hear this everywhere. It's a little wrong, and the confusion causes real bugs.
JWT is not authentication. Let me explain what it actually is. 🧵
SpringSecurity - Day 23
The accurate way to say it:
Authentication = checking credentials (login).
JWT = a stateless way to REMEMBER that authentication on later requests.
It's a way to carry proof, not the proving itself.