REST Apis are session less. You can not maintain the authentication session for the whole application. For that purpose, JSON web token (JWT) comes in play. How it works:
- User hits the
loginorauthenticateendpoint with valid credentials. - In response, if user is authenticated, user get’s a
access-token (JWT), which contains the user’s info likeusernameandrole. - You need to pass
JWTinAuthorizationheader with every protected endpoint. - With this, the server knows a valid and authenticated user is accessing the resource.
JWThas a expiry date, it does not live forever.- Also need to note that,
JWTis not saved in database.
What is the refresh token and why we need it?
You are thinking that, if I can do authentication with JWT, then why do I bother to create a refresh token. Let me break it down











