Hardening security with JWT

What’s the benefit of JWT rather than basic authentication? Well, with JWT, you can have more granular control over what the client can do. You can include claims in the token that specify what the client is allowed to do. For example, you can include a claim that specifies that the client is only allowed to read data, but not write data. This would look like something like this:

{
  "sub": "1234567890",
  "name": "User Userson",
  "admin": true,
  "iat": 1516239022,
  "exp": 1516242622,
  "scopes": ["User.Read"]
}

This token payload specifies that the client is allowed to read user data. The server can then check the token and see whether the client has the required scope to perform the requested action. There are a lot of other benefits as well, such as the following:

• Stateless: The server doesn’t need to store any session information...