JWT tokens require, at most, a one-time communication between the resource server and the authorization server at runtime. The resource server needs to request the authorization server for the public key to decrypt the JWT tokens. This can be done at resource server startup. This can even be stored in the resource server in a properties file avoiding the query at all. OAuth2 solve a problem that user wants to access the data using client software like browser-based web apps, native mobile apps, or desktop apps. OAuth2 is just for authorization, client software can be authorized to access the resources on behalf of end-user using an access token. OAuth2 can be used with JWT tokens or access token which is a bearer token.

Jwt是一组用于发布和验证已签名访问令牌的严格指令。令牌包含应用程序用来限制用户访问的声明

OAuth2 on the other hand is not a protocol, its a delegated authorization framework. think very detailed guideline, for letting users and applications authorize specific permissions to other applications in both private and public settings. OpenID Connect which sits on top of OAUTH2 gives you Authentication and Authorization.it details how multiple different roles, users in your system, server side apps like an API, and clients such as websites or native mobile apps, can authenticate with each othe

注意oauth2可以与jwt一起工作，实现灵活，可扩展到不同的应用程序

OAuth 2.0定义了一个协议，即指定了令牌如何传输，JWT定义了令牌格式。

OAuth 2.0和“JWT身份验证”在客户端向资源服务器提供令牌的(第二)阶段具有类似的外观:令牌在头文件中传递。

但是“JWT身份验证”不是一个标准，并且没有指定客户端首先如何获得令牌(第一阶段)。这就是OAuth复杂性的来源:它还定义了客户端从所谓的授权服务器获取访问令牌的各种方式。

因此，真正的区别在于JWT只是一种令牌格式，OAuth 2.0是一种协议(可以使用JWT作为令牌格式)。

JWT (JSON Web令牌)——它只是一种令牌格式。JWT令牌是JSON编码的数据结构，包含有关发行者、主题(索赔)、到期时间等信息。对它进行签名以防止篡改和真实性，并且可以使用对称或非对称方法对它进行加密以保护令牌信息。JWT比SAML 1.1/2.0更简单，所有设备都支持它，而且它比SWT(简单Web令牌)更强大。

OAuth2 - OAuth2解决了用户想要使用客户端软件访问数据的问题，如基于浏览的web应用程序，本地移动应用程序或桌面应用程序。OAuth2仅用于授权，可以通过访问令牌授权客户端软件代表最终用户访问资源。

OpenID连接- OpenID连接构建在OAuth2之上，并添加身份验证。OpenID Connect向OAuth2添加了一些约束，如UserInfo端点、ID令牌、OpenID Connect提供程序的发现和动态注册以及会话管理。JWT是令牌的强制格式。

CSRF保护-如果您不将令牌存储在浏览器的cookie中，则不需要实现CSRF保护。

Firstly, we have to differentiate JWT and OAuth. Basically, JWT is a token format. OAuth is an authorization protocol that can use JWT as a token. OAuth uses server-side and client-side storage. If you want to do real logout you must go with OAuth2. Authentication with JWT token can not logout actually. Because you don't have an Authentication Server that keeps track of tokens. If you want to provide an API to 3rd party clients, you must use OAuth2 also. OAuth2 is very flexible. JWT implementation is very easy and does not take long to implement. If your application needs this sort of flexibility, you should go with OAuth2. But if you don't need this use-case scenario, implementing OAuth2 is a waste of time.

XSRF令牌总是在每个响应头中发送给客户端。CSRF令牌是否在JWT令牌中发送并不重要，因为CSRF令牌本身是安全的。因此，在JWT中发送CSRF令牌是不必要的。

JWT tokens require, at most, a one-time communication between the resource server and the authorization server at runtime. The resource server needs to request the authorization server for the public key to decrypt the JWT tokens. This can be done at resource server startup. This can even be stored in the resource server in a properties file avoiding the query at all. OAuth2 solve a problem that user wants to access the data using client software like browser-based web apps, native mobile apps, or desktop apps. OAuth2 is just for authorization, client software can be authorized to access the resources on behalf of end-user using an access token. OAuth2 can be used with JWT tokens or access token which is a bearer token.