What authentication and authorization protocols do you know? Tell me about JWT.

Among popular authentication and authorization protocols, the following can be highlighted:

• Basic Auth — transmitting login and password in the HTTP header (not secure without HTTPS).
• OAuth 2.0 — an authorization protocol that allows third-party applications to obtain limited access to user resources.
• OpenID Connect — an extension over OAuth 2.0 for user authentication.
• SAML — a protocol for exchanging authentication and authorization data, often used in corporate systems.
• JWT (JSON Web Token) — a compact token for transmitting user information and rights.

JWT is a self-contained token that contains encoded information (payload), signed with a secret key or a pair of keys (for authenticity). The token consists of three parts separated by dots:

1. Header — contains the token type and signing algorithm.
2. Payload — data (e.g., user ID, roles, expiration time).
3. Signature — a digital signature to verify integrity.

Example of JWT:

xxxxx.yyyyy.zzzzz

JWT is widely used for authentication in web applications: the server issues a token after successful login, the client stores it (e.g., in localStorage), and sends it with each request in the Authorization header. The server verifies the signature and extracts user data without needing to store sessions.

Advantages of JWT:

• Stateless on the server.
• Easily scalable.
• Can transmit arbitrary data.

Disadvantages:

• If the token is stolen, an attacker can use it until it expires.
• Requires careful management of token lifespan and renewal.