What is the purpose and use of JSON Web Tokens in an authorization system?

JSON Web Tokens (JWT) are used for secure transmission of information between the client and server in authentication systems. JWT contains an encoded payload with user data and is signed with a secret key, allowing the server to verify the token's authenticity without needing to store a session.

Main purposes of JWT:

• Authentication: after a successful login, the user receives a JWT, which is sent with each request to confirm their identity.
• Authorization: access rights can be stored in the token, enabling the server to make decisions without additional database queries.

Example of usage:

POST /login
{
  "username": "user",
  "password": "pass"
}

Response:
{
  "token": "eyJhbGciOiJIUzI1NiIsInR5cCI6..."
}

Then the client sends this token in the Authorization header:

GET /protected-resource
Authorization: Bearer eyJhbGciOiJIUzI1NiIsInR5cCI6... 

The server verifies the signature and extracts data from the token to make access decisions.