Why do we need JWT when we have client sessions?

Question

I understand that JWT are stateless tokens that store signed information about the client's claim and are passed to a server via the Authorization HTTP header.

My question is, why do we need JWT when we already have client sessions (https://github.com/mozilla/node-client-sessions)? Client sessions are conceptually the same. They're cookies that contained signed information which when verified means the cookie hasn't been tempered with. Also, client sessions are stored in a cookie and passed via the Cookie HTTP header. It's the same thing only using different words. Am I wrong?

So, why is JWT even around? I could understand that maybe the point is to standardize the way authentication tokens work, but we got along fine without a session ID based standard (each implementation did things their own way). Also, why would the JWT not use cookies as a means of transfer. With cookies, you wouldn't need explicitly send the correct header for every request (simplifying Ajax requests).

Am I missing something?

Dovap

Answer 1

JWT tokens are signed JSON formatted documents that assert claims about a user (or any principal). If you trust the issuer of the token, you trust the claims in the token and can make authorization decisions based on this.

JWT tokens are often used for calling external Web APIs. These APIs do not necessarily live on the same domain as your website and therefore cannot use the same cookies as your site. JWT tokens are used in REST services as they do not need any session info stored on the server. Using JWT tokens is also not vulnarable to CSRF attacks.

Crabber

Note: According the Stormpath guys here (stormpath.com/blog/… ) - JWT tokens are vulnerable to CSRF attacks if stored in cookies. – Avantgarde

Sure, if you store the JWT in a cookie and use it to authenticate your API, you're back with implicit authentication. JWT tokens are typically not stored in cookies, but sent as bearer tokens in the Authorization HTTP header. See also this article: leastprivilege.com/2015/04/01/… – Crabber