JWT Authentication

JWTs encode claims in a signed, self-contained token. They enable stateless authentication across distributed services. Key concepts: header/payload/signature structure, RS256 vs HS256, token expiration, refresh token rotation, token revocation strategies, and common vulnerabilities (none algorithm, JWT confusion).