Welcome to the last type of authentication system, and that is token based authentication or using
what is called JSON web token, that is JWT for shops.
And this kind of authentication is mostly used and it's modern.
So if you want to build a real world application by implementing authentication, then I advise you
to use what is called token based authentication.
And for my client projects, this is the type of authentication that I use because it is secured and
modern.
So what is token based authentication?
Well, explaining this is somehow difficult than showing you in a code.
So most instructors find it difficult to explain in details how the token based authentication work
using diagrams.
So in this video, I tried my best to make it pretty simple by taking you through the process of using
token based authentication.
So let's get started.
Do you remember this diagram when we're talking about session based authentication, but we are going
to change some terms and processes in the mix.
So as always, let's say that we already have the registered user and this user is trying to log in
into our application.
So the first step is we need the server.
So as soon as a user makes a request, then the details will send to the server and the server will
make a request to database to check if there is a user.
So if there is a user, then inside our server we are going to incorporate what is called JWT package.
So inside our server then this function is going to generate what is called token and then send it to
the user's browser and save it into what is called the cost storage.
So this is the flow one more time when a user logs in successfully, then our server is going to talk
to this package called JWT and then this package is going to generate a token and then save it into
the user's browser.
So upon every request, the user need to send the same token as part of the header.
And then when it gets to our server, it is the responsibility of the JWT to verify the token.
So before it verified, as soon as the token is generated, let's see what goes on here.
This package is going to take an identifier from the user.
We can sign the token with a person, email or ID or full name whatever, so that identity will be inside
the token generated.
So upon every request, our browser is going to send the token as a header and then the package is going
to verify the token called decoded.
So what is the code that can verify?
We are going to see the login user that was used to sign in the token.
So that is the basic flow of the JSON web token.
So in case somebody tampered with the token, then it's going to reject and says that token expired
or invalid token.
And if everything is correct, why not?
I'm going to give you the go ahead to use the application because now the token has been verified.
So with this one being in mind, the next video, let's get started with how we can implement the token
based authentication by moving step by step.