Search code examples
ruby-on-railsreactjsdevisejwt

What's the use of JWT in Rails + React app for Auth

I don't understand the use of JWT token..
Can anyone explain it to me ?
Because currently i'm working on an app (rails + react), and I want to use devise + jwt for authentification and React for frontend.

Actually, I understood that :

1/ If a user want to login: he completes the form, React get Data from form and make a post request of these infos to Rails API.

2/ Rails API get theses infos check in the db if infos match with a registered user, if it is then Rails API will create a JWT token and will send this token to React.
User is now logged in because Rails API found a matched user.

3/ React receive the JWT token. ( ?? what the usage of this token ?? )

thanks

Solution

  • My response is not specific to Rails/React, but rather to all web technologies using JWT tokens:

    What you said is correct. From point 3 forward, all the requests made from React to the Rails backend will have to contain the header Authorization: Bearer <token>.

    When Rails sees that header, it is able to:

    • checks the token is valid, by checking its signature
    • decode it and extract any info stored in it.

    Remember that JWT tokens can contain any info the backend wants to store in it. And the client is not able to tamper it, because it is signed cryptographically and it would invalidate its signature.

    The above properties (the fact you can store anything in it, that the frontend sends it with every request and that nobody can tamper it) help any web application being able to: