JWT stateless understanding

        JSON Web Tokens  (JWT) are said to be stateless because the authorization server does not need to maintain any state; the token itself is all that is needed to verify the authorization of the token holder.

        JWTs are signed using a digital signature algorithm (eg RSA) and cannot be forged. Therefore, anyone who trusts the signer's certificate can safely trust that the JWT is authentic. The server need not consult the token-issuing server to confirm its authenticity.

        Note that in this diagram, the resource server does not need to check with the authorization server :

Client access API server

 

Guess you like

Origin blog.csdn.net/liuqinhou/article/details/132009347
jwt