How does server know request is from logged-in user without storing session on server?
Per Wikipedia: “API authentication over HTTP often uses token in Authorization header — Bearer JWT or session cookie — verified per request.”
Like wristband at festival — gate checks band each entry, does not remember your face.
- Client logs in, gets token
- Client sends Authorization: Bearer
each request - Server verifies signature/expiry
- Server loads principal
- Returns 401 if invalid
- Stateless — token carries claims
- Short expiry plus refresh
- Bearer must be over HTTPS
- Revocation needs denylist
Authorization: Bearer eyJ...- Built from: HTTP Headers — auth travels in header
- Related: HTTP Status Codes — 401/403
- Related: Statelessness — stateless auth fits
- Builds into: CORS — creds needs CORS allow
- Storing JWT in localStorage XSS risk
- Long-lived token without refresh