Why do many people not recommend using JWT?

My article is open to everyone; non-member readers can click this link to read the full text. Lorem ipsum dolor sit amet

If you often look at online tutorials for building projects, you’ll notice that many of them use JWT.

But is it really safe?

Why do so many people advise against using it? This article will provide you with a comprehensive understanding of JWT and its pros and cons.

What is JWT?

Here is the official website: JSON Web Tokens — jwt.io

This is what JWT is.

If you’re not familiar with JWT, don’t worry! They’re not that complicated!

You can think of JWT as a piece of JSON data that you can verify to confirm that the data comes from someone you trust.

Of course, we won’t go into how it’s implemented here, but if you’re interested, you can look into it yourself.

Now, let’s talk about its process:

1. When you log in to a website, the website generates a JWT and sends it to you.
2. The JWT acts like a package that contains some identity information about you, such as your username, roles, permissions, etc.
3. Then, you carry this JWT with you every time you communicate with the website.
4. Whenever you access a page that requires authentication, you present this JWT to the website.
5. When the website receives the JWT, it verifies its signature to ensure that it was issued by the website and checks the information within it to confirm your identity and permissions.
6. If everything checks out, you’re allowed to continue accessing the protected page.

Why is JWT considered bad?

First, when we use JWT, it’s typically for tasks like:

• User registration on a website
• User login on a website
• User clicks and performs actions
• The website uses the user’s information to create, update, or delete data

These tasks often involve database operations such as:

• Recording the actions a user is performing
• Adding some user data to the database
• Checking the user’s permissions to see if they can perform certain actions

Now, let’s go over some of its drawbacks step by step

JSON