JWT authentication

JWT authentication uses signed JSON objects to securely transmit identity claims between a client and a server without requiring session state.

Stateless authentication relies on the JSON Web Token (RFC 7519) to eliminate database lookups for session validation. The process is straightforward: the server issues a digitally signed token (HMAC SHA256 or RSA) containing user metadata; the client stores this in local storage or a cookie and includes it in the Authorization header for subsequent API calls. This architecture enables seamless horizontal scaling across server clusters and facilitates secure cross-domain resource sharing (CORS) by keeping the authentication logic self-contained within the token payload.

https://jwt.io/introduction