JSON Web Token
also called JWT
A signed, self-contained token carrying claims, which a service can validate locally without calling the issuer.
The appeal is stateless validation: any service with the issuer's public key can verify the signature and read the claims, with no shared session store and no network hop.
The cost is that a JWT cannot be un-issued. Once signed, it is valid until it expires, so logout, role changes and account suspension do not take effect until then. That is the central trade, and the practical answers are short expiry (minutes) with refresh tokens, or a revocation check that gives up some of the statelessness.
Validation must be complete or it is worthless: verify the signature, pin the expected algorithm
(never trust the token's own alg header — accepting none or a downgrade to HMAC using the
public key as the secret are both classic exploits), and check issuer, audience and expiry.
Keep them small and free of sensitive data — a JWT is signed, not encrypted, so anyone holding it can read every claim.