In a token-based system, HS256 and RS256 are the two most common algorithms used to sign the token.

1. HS256

• This method is mostly used in monolith application, where it only requires single key.

• Token Based auth is state-less it means not need to store user sessions, Instead server provides a Signed_Token (digital pass) to user.

• For every sub-sequent query u must have to provide that Signed_Token to verification.

How it’s work?

1. Login - user submit their credential to server.

2. Verification and creation - if credential is correct against DB, it creates Signed_Token (JWT) using secret_key send back to client.

3. Cookie - Server send back response with header of set_cookieincludes Signed_Token with flags httponly secure .

4. Browser - it automatically store the Signed_Token .

5. Subsequent request - in every future server request, browser attach cookie of Signed_Token header requests.

6. Server validation - it pull the Signed_Token from header cookie and verify it’s digital signature and expiry_date using secret_key, and process the request.

2. RS256

This method is best for micro_service distributed_systems application.

How it’s work?

• The process is same as HS256 but Auth_server keeps private_key to sign in the token and gives public_key to other services to verify the token