The token authentication flow

Token-based authentication can be understood with the following example authentication flow:

1. The user sends their credentials, for example, username and password, from the client app on their browser to the server.
2. The server checks the username and password and returns a signed token (the JWT) if the credentials are correct.
3. This token is stored on the client side. It can be stored in local storage, session storage, or in a cookie.
4. The client app generally includes this token as an additional header on any subsequent request to the server.

5. The server receives and decodes the JWT and then allows request access if the token is valid.
6. The token is destroyed on the client side when the user logs out and no further interaction with the server is needed.

In token-based authentication, generally, you should not include any sensitive information in the payload and the token should not be kept over a long period. The additional header that you use to include...