C: Client.
s: Server.

C: POST `/login` with username and password.
s: Creates a JWT with a secret and sends the JWT to the browser.
C: Sends the JWT when making API calls.
s: Checks the JWT signature. Gets user information from the JWT and sends response to the client.

My question is why do we need JWT if we can generate an RSA key pair for each user, encrypt/sign/verify the user information with the private key?

The client can’t tamper it since the private key will not leave the server. Also, with RSA we can implement the “logout” by deleting the RSA key pair associated with the user and generate a new one.

By using RSA you keep it stateless, the information needed is carried by the token itself (+ in a private manner because it is encrypted).

This is valid not only for RSA, but for any other asymmetric encryption algorithm that supports signing.

So why do we need JWT? Is JWT more “lightweight”? Is JWT just a wrapper for asymmetric encryption (since it supports using RSA to sign tokens)? Is JWT just the pattern/standard way of doing it?

I know it has 99% chance of being a stupid question because I couldn’t find anyone asking it, but I wanna understand what I don’t understand.

Thank you in advance.