Authentication is one of the core functions of applications on the internet today, one that many developers are familiar with. Yet, actually implementing authentication correctly requires understanding several standards and protocols.

Two of the most important of these authentication standards are OAuth and JWT (JSON Web Tokens).

Looking to make sense of OAuth and JWT? You’re in the right place. In this article we will cover:

Let’s dive in!

What is OAuth?

OAuth (Open Authorization) - often written as the latest version OAuth 2.0 - is a protocol that is used to authenticate a user via an authentication server.

One of the useful things about OAuth is that it enables you to delegate account access in a secure way without sharing credentials. Instead of credentials, OAuth relies on access tokens.

Using access tokens, a client application can verify the identity of the user that authenticated themselves.

Visually, the process looks like this:

When you implement "Sign in with Google" or "Sign in with Github", you are using the OAuth 2.0 protocol!

Pros of using OAuth

Working with OAuth has some great benefits, including:

Potential considerations of using OAuth

While OAuth is a great standard, there’s a handful of things to be mindful of when using it:

What is JWT (JSON Web Tokens)?

A JWT is a token that is generated by the authentication server and contains the end-user’s information (like their userID, email, etc.). The information is in JSON format and can be efficiently verified by the client application using cryptography.

So when exactly is using a JWT appropriate?

JWT is best used whenever you want to transmit some information to an untrusted client, in such a way that that client can verify the information contained in the payload themselves.

From the context of an auth server, an untrusted client is an application that the user is trying to use. From the context of the application’s backend, an untrusted client is the frontend code.

Pros of using JWT

There are some good reasons JWT is such a popular standard:

Potential considerations of using JWT

While JWTs are incredibly useful - it’s helpful to keep the following things in mind:

Better together: How to use OAuth and JWT together

We’ve learned that OAuth and JWT are powerful standards for building authentication flows in applications. As it turns out - OAuth vs JWT doesn’t have to be either or - they can be used together!

When the authentication server successfully verifies a user’s credentials (via OAuth) it also needs to transmit the user details to the client application. In order for the client application to verify the details, JWTs can be used to ensure an efficient process.

This works by the OAuth server sending a JWT to the client (after the OAuth flow is complete) containing the end user’s information.

A typical JSON payload in the JWT sent by the OAuth server looks like the below (example from sign in with Google):

{
    "iss": "https://accounts.google.com",
    "azp": "1234987819200.apps.googleusercontent.com",
    "aud": "1234987819200.apps.googleusercontent.com",
    "sub": "10769150350006150715113082367",
    "at_hash": "HK6E_P6Dh8Y93mRNtsDB1Q",
    "email": "[email protected]",
    "email_verified": "true",
    "iat": 1353601026,
    "exp": 1353604926,
    "nonce": "0394852-3190485-2490358",
    "hd": "example.com",
}

What do all these fields mean? Below is a quick summary using this particular example:

As you can see, there is a lot of information transmitted from the OAuth server (Google in this case) to the client application! It’s worth mentioning that some of the fields in the above JSON payload are specific to Google (like hd). Other providers may have similar and different content.

Since this is all in a JWT, the client application can verify the contents of this JSON and know that no one has manipulated this content.

Final thoughts

Oftentimes we see developers asking whether to use "OAuth or JWT" for their authentication setup. In reality, OAuth and JWT are two different standards, with different uses, which can be used together with great effect. In fact, JWT is often used as part of the OAuth protocol.

At SuperTokens, we provide an auth solution that mitigates most of the cons of using OAuth and a JWT, including:

Written by the Folks at SuperTokens — hope you enjoyed! We are always available on our Discord server. Join us if you have any questions or need any help.