What’s the similarity and difference between JWT and cookies
tags: learning programming diff-between
content
They are both used to maintain some sort of state (e.g., authentication) for http requests (http is stateless)
-
JWT is a standardized way to format data
-
cookie is a mechanism defined by RFC, it is a part of http standard (
Set-Cookie,Cookie) -
cookies can contain more information than just authentication (e.g., analytics)
-
cookies could just be JWT inside (you can store JWT in cookies)
- cookies are mainly for browsers
- cookies are automatically stored by the browser and included in the future requests
- cookies often references some session data in server side
-
JWT is more commonly for direct API requests