Odtnhj

As the title suggests, where are JWT tokens stored on the server side? in database or in memeory? I understand the implementation can vary due to different requirements, but just in general where would you store it?

If I want to provide a very basic token authentication server, meaning upon receiving a username and password via a POST request, I would like to return a token. In this case, how is a token generated with a very basic algorithm work differently than a jwt token?

With a token generated by a simple algorithm:

1. it does not contain payload


2. its value is not computed based on the username and password, thus it cannot be rehashed back to anything meaningful

In this case, is there still value to use JWT?

Thanks!

client needs to store it, on server storage is not required.

JWT have all the claims in itself and is signed by the server as well. On receipt, server checks for the signature and reads the claims. It does not match it against a stored value. That is the whole point of using JWT against access tokens.

Look at how a JWT is structured.

Jwt token is not required to be stored but the "secret-key" needs to be stored.
The structure of jwt is header.payload.signature where signature is generated as below by the server :

signature = HS256(base64Header + '.' + base64Payload, 'mysecret')

So in essense:

1.header.payload.signature is sent to client on first sign in

2.client return back header.payload.signature in subsequent api call
3.server decodes it for verification as below:
base64Header, base64Payload, signature = token.split('.')

header = base64Decode(base64Header) 
payload = base64Decode(base64Payload)

serverComputedSignature = HS256(base64Header + '.' + base64Payload, 
'mysecret')

if serverComputedSignature != signature: 
 print('FAILED')

You don't need to store token on server side.
You should store a private key ( any string of your choice)at server preferably as environment variable.The jsonwebtoken provided method use this private key to generate a token to pass to client.
Client has to store this token at client side so that it can pass this token to subsequent request to server in header.
Server would extract the token value from header and validate it using private key by calling a method of jsonwebtoken.If token is not modified by any means then validate will succeed.