Authorization
Authorization is verifying what a specific user can do or has access to in the application. It's a next step after a user's identity is confirmed and determines what parts of the application the user is allowed to use.
Generally, we authorize after a user has been authenticated.
"Now that we know who you are, here is what you are allowed to do and NOT allowed to do."
In a web application, once we have verified a user's credentials - authentication - we need a way to create a session or token that includes the user's identity and permissions. A popular way to implement this 'session' is with a JWT.
Authorization with JWTs
JWTs - JSON web tokens - are encrypted hashes generated on every login. JWTs represent the identity of the user or session that can be verified on the server side without having to store session data in the database. We check the token on every request to determine whether the user is allowed to access the requested resource.
A jwt is like a ticket that gets you access to certain events. Whenever you want to attend an event, your ticket (jwt) needs to be verified. If you delete your jwt, you can't attend events without going back to the ticket provider to get another ticket. And if your ticket reaches its expiration date, it is no longer valid to grant access.
Storing JWTs
JWTs can be stored in the localStorage provided by the browser or in a cookie.