Get my system design playbook for FREE on newsletter signup:
This post outlines how JSON Web Token works. You will find references at the bottom of this page if you want to go deeper.
Share this post & I'll send you some rewards for the referrals.
Note: This post is based on my research and may differ from real-world implementation.
Once upon a time, there lived a software engineering student named Keiko.
Although extremely bright, she never worked on any real-world projects.
So she struggled with coding.
Until one day, when she decided to build a weather app.
And shared it with her friends.
Yet she had no idea how user authorization worked.
HTTP is stateless; it means each request should include the necessary information.
And her friends had to enter their username and password on each page for authorization.
It was frustrating.
So she set up a session store on the server:
It tracks user sessions and gives a session ID to the client.
And the client includes the session ID with each request header.
The server then checks the session store to identify the client for access.
Although it temporarily solved the authorization problem, there were newer issues.
Her tiny app became popular among university students across the world.
So she had to install more servers and put them behind a load balancer.
But it became difficult to manage sessions with many servers.
Because the load balancer might route requests from a user to different servers.
So she set up sticky sessions. It means routing requests from a specific user to the same server using their user ID or IP address.
Yet it doesn’t scale well because of stateful servers and uneven load distribution.
So she installed a shared session store. It keeps session data separate in a central store.
A shared session store allows stateless servers. But introduces coupling and becomes a single point of failure.
So she set up JSON Web Token (JWT) for authorization.
Think of JWT as a badge to enter a building. A user gets the badge from the front desk after verification. Then they can access authorized rooms without verifying their identity again.
The server doesn’t store session information with JWT. Instead JWT includes necessary authorization information, and the server checks the JWT on each request.
Imagine authentication as permission to enter a building. And authorization as the permission to enter specific rooms of the building.
Onward.
Linear: Issue tracking without the noise - Sponsor
Simple, robust, and blazingly fast.
Linear is purpose-built for engineers:
Create issues in seconds
Automate your Git workflows
Navigate your entire workflow with keyboard shortcuts
Less grunt work, less context switching. More focus, more flow. See for yourself with $250 off.
How JWT Works
Let’s dive in: