CODEWITHSUNDEEP
securityoauthjwt
Vishal
Vishal

Reputation: 107

Should I use OAuth or JWT?

Im building a REST services for existing product. Now to authenticate these, there needs to be some mechanism. To give specifications, I have a Db which stores userid and password . I have to authenticate using these credentials.

In above should I use OAuth or JWT? I prefer to use JWT to generate token first and pass token along every request.

Also From my understanding, I understand OAuth should be used when you have multiple consumers like games/apps using Facebook login. In my case, I don't have any have multiple consumers.

Please advise

Upvotes: 0

Views: 236

Answers (1)

blur0224
blur0224

Reputation: 1012

Although it is true that OAuth is an authorization framework, it does help with JWT. JWT is a token specification, meaning, how you manage and issue tokens is largely left undefined. For instance, when your token reaches it's expiration, do you want your user to be abruptly logged out? By default, if you're using tokens with a certain duration, this will happen if you're checking for expired tokens, which you should be doing.

An OAuth Authentication server can serve the purpose of issuing an Access Token in JWT, and a Refresh Token. The access token will be included in every request, and the refresh token can be used when the access token is expired or about to expire to acquire a new access token. This is useful when taking into account the potential need to revoke a users access to your application. If you set a short access token life, then you'll be able to revoke access more quickly by removing their refresh token.

The technologies are different and not directly comparable because they solve different problems and are intended for different uses.

Upvotes: 1

Related Questions