What is a JWT

With form login, the server remembers you in an HTTP session and the browser sends a JSESSIONID cookie. A REST API used by a React app or a mobile app usually works differently: after login the server gives the client a token, and the client sends it on every request in the Authorization header. The server keeps nothing in memory. This is called stateless authentication.

1. POST /api/auth/login {email, password}  ---------------->  Spring Boot
                                                                 checks password
2.                     <------------------------------------  200 {"accessToken": "eyJ..."}

3. GET /api/orders
   Authorization: Bearer eyJ...  -------------------------->  JWT filter verifies signature
                                                                 and expiry, sets SecurityContext
4.                     <------------------------------------  200 [ ...orders... ]

A JSON Web Token (JWT, pronounced "jot") is three Base64url strings joined with dots: header.payload.signature.