When you register for a new website, often you are sent an email to activate your account. That email typically contains a link to click on. Part of that link, contains a token, the server knows about this token and can associate it with your account. The token would usually have an expiry date associated with it, so you may only have an hour to click on the link and activate your account. None of this would be possible with cookies or session variables, since its unknown what device or browser the customer is using to check emails.

我认为这里已经解释得很好了——只是引用了这篇长文的关键句子:

a背后的一般概念 基于令牌的认证系统是 简单。允许用户输入他们的 用户名和密码，以便 获得一个令牌，允许他们这样做 获取一个特定的资源-没有 使用用户名和密码。 一旦获得了他们的令牌， 用户可以提供令牌 提供对特定资源的访问 在一段时间内，对着遥控器 网站。

换句话说:为身份验证添加一个间接级别——用户不必为每个受保护的资源使用用户名和密码进行身份验证，而是以这种方式进行一次身份验证(在有限持续时间的会话内)，获得一个有时间限制的令牌作为回报，并在会话期间使用该令牌进行进一步的身份验证。

好处有很多——例如，用户一旦获得令牌，就可以将令牌传递给其他一些自动化系统，他们愿意在有限的时间和有限的资源集内信任这个系统，但不愿意信任他们的用户名和密码(即，他们被允许访问的每一个资源，永远或至少直到他们更改密码)。

如果还有什么不清楚的地方，请编辑你的问题，澄清你不是100%清楚的东西，我相信我们可以进一步帮助你。

基于令牌的(安全/身份验证)

This means that in order for us to prove that we’ve access we first have to receive the token. In a real-life scenario, the token could be an access card to the building, it could be the key to the lock to your house. In order for you to retrieve a key card for your office or the key to your home, you first need to prove who you are and that you in fact do have access to that token. It could be something as simple as showing someone your ID or giving them a secret password. So imagine I need to get access to my office. I go down to the security office, I show them my ID, and they give me this token, which lets me into the building. Now I have unrestricted access to do whatever I want inside the building, as long as I have my token with me.

基于令牌的安全性有什么好处?

回想一下不安全API，在这种情况下，我们必须为我们想做的所有事情提供密码。

Imagine that every time we enter a door in our office, we have to give everyone sitting next to the door our password. Now that would be pretty bad because that means that anyone inside our office could take our password and impersonate us, and that’s pretty bad. Instead, what we do is that we retrieve the token, of course together with the password, but we retrieve that from one person. And then we can use this token wherever we want inside the building. Of course, if we lose the token, we have the same problem as if someone else knew our password, but that leads us to things like how do we make sure that if we lose the token, we can revoke the access, and maybe the token shouldn’t live for longer than 24 hours, so the next day that we come to the office, we need to show our ID again. But still, there’s just one person that we show the ID to, and that’s the security guard sitting where we retrieve the tokens.

问题老了，技术先进了，现在的状态是这样的:

JSON Web Token (JWT)是一个基于JSON的开放标准(RFC 7519)，用于在Web应用程序环境中在各方之间传递声明。令牌的设计是紧凑的，url安全的和可用的，特别是在web浏览器单点登录(SSO)上下文中。

https://en.wikipedia.org/wiki/JSON_Web_Token

从Auth0.com

Token-Based Authentication, relies on a signed token that is sent to the server on each request. What are the benefits of using a token-based approach? Cross-domain / CORS: cookies + CORS don't play well across different domains. A token-based approach allows you to make AJAX calls to any server, on any domain because you use an HTTP header to transmit the user information. Stateless (a.k.a. Server side scalability): there is no need to keep a session store, the token is a self-contained entity that conveys all the user information. The rest of the state lives in cookies or local storage on the client side. CDN: you can serve all the assets of your app from a CDN (e.g. javascript, HTML, images, etc.), and your server side is just the API. Decoupling: you are not tied to any particular authentication scheme. The token might be generated anywhere, hence your API can be called from anywhere with a single way of authenticating those calls. Mobile ready: when you start working on a native platform (iOS, Android, Windows 8, etc.) cookies are not ideal when consuming a token-based approach simplifies this a lot. CSRF: since you are not relying on cookies, you don't need to protect against cross site requests (e.g. it would not be possible to sib your site, generate a POST request and re-use the existing authentication cookie because there will be none). Performance: we are not presenting any hard perf benchmarks here, but a network roundtrip (e.g. finding a session on database) is likely to take more time than calculating an HMACSHA256 to validate a token and parsing its contents.

它只是哈希与数据库中的用户或其他方式相关联。该令牌可用于身份验证，然后授权用户访问应用程序的相关内容。要在客户端检索此令牌，需要登录。第一次登录后，你需要保存检索到的令牌，而不是任何其他数据，如会话，会话id，因为这里的一切都是令牌，以访问应用程序的其他资源。

令牌用于确保用户的真实性。

更新: 目前，我们有更先进的基于令牌的技术，称为JWT (Json Web令牌)。这种技术有助于在多个系统中使用相同的令牌，我们称之为单点登录。

基本上，基于JSON的令牌包含用户详细信息和令牌到期详细信息。因此，如果令牌无效或过期，可以根据详细信息使用该信息进一步验证或拒绝请求。