Firstly, we have to differentiate JWT and OAuth. Basically, JWT is a token format. OAuth is an authorization protocol that can use JWT as a token. OAuth uses server-side and client-side storage. If you want to do real logout you must go with OAuth2. Authentication with JWT token can not logout actually. Because you don't have an Authentication Server that keeps track of tokens. If you want to provide an API to 3rd party clients, you must use OAuth2 also. OAuth2 is very flexible. JWT implementation is very easy and does not take long to implement. If your application needs this sort of flexibility, you should go with OAuth2. But if you don't need this use-case scenario, implementing OAuth2 is a waste of time.

XSRF令牌总是在每个响应头中发送给客户端。CSRF令牌是否在JWT令牌中发送并不重要，因为CSRF令牌本身是安全的。因此，在JWT中发送CSRF令牌是不必要的。

Jwt是一组用于发布和验证已签名访问令牌的严格指令。令牌包含应用程序用来限制用户访问的声明

OAuth2 on the other hand is not a protocol, its a delegated authorization framework. think very detailed guideline, for letting users and applications authorize specific permissions to other applications in both private and public settings. OpenID Connect which sits on top of OAUTH2 gives you Authentication and Authorization.it details how multiple different roles, users in your system, server side apps like an API, and clients such as websites or native mobile apps, can authenticate with each othe

注意oauth2可以与jwt一起工作，实现灵活，可扩展到不同的应用程序

JWT (JSON Web令牌)——它只是一种令牌格式。JWT令牌是JSON编码的数据结构，包含有关发行者、主题(索赔)、到期时间等信息。对它进行签名以防止篡改和真实性，并且可以使用对称或非对称方法对它进行加密以保护令牌信息。JWT比SAML 1.1/2.0更简单，所有设备都支持它，而且它比SWT(简单Web令牌)更强大。

OAuth2 - OAuth2解决了用户想要使用客户端软件访问数据的问题，如基于浏览的web应用程序，本地移动应用程序或桌面应用程序。OAuth2仅用于授权，可以通过访问令牌授权客户端软件代表最终用户访问资源。

OpenID连接- OpenID连接构建在OAuth2之上，并添加身份验证。OpenID Connect向OAuth2添加了一些约束，如UserInfo端点、ID令牌、OpenID Connect提供程序的发现和动态注册以及会话管理。JWT是令牌的强制格式。

CSRF保护-如果您不将令牌存储在浏览器的cookie中，则不需要实现CSRF保护。

Firstly, we have to differentiate JWT and OAuth. Basically, JWT is a token format. OAuth is an authorization protocol that can use JWT as a token. OAuth uses server-side and client-side storage. If you want to do real logout you must go with OAuth2. Authentication with JWT token can not logout actually. Because you don't have an Authentication Server that keeps track of tokens. If you want to provide an API to 3rd party clients, you must use OAuth2 also. OAuth2 is very flexible. JWT implementation is very easy and does not take long to implement. If your application needs this sort of flexibility, you should go with OAuth2. But if you don't need this use-case scenario, implementing OAuth2 is a waste of time.

XSRF令牌总是在每个响应头中发送给客户端。CSRF令牌是否在JWT令牌中发送并不重要，因为CSRF令牌本身是安全的。因此，在JWT中发送CSRF令牌是不必要的。

JWT tokens require, at most, a one-time communication between the resource server and the authorization server at runtime. The resource server needs to request the authorization server for the public key to decrypt the JWT tokens. This can be done at resource server startup. This can even be stored in the resource server in a properties file avoiding the query at all. OAuth2 solve a problem that user wants to access the data using client software like browser-based web apps, native mobile apps, or desktop apps. OAuth2 is just for authorization, client software can be authorized to access the resources on behalf of end-user using an access token. OAuth2 can be used with JWT tokens or access token which is a bearer token.

JWT是一个开放标准，它定义了一种紧凑且自包含的方式，用于在各方之间安全地传输信息。这是一种身份验证协议，我们允许编码的声明(令牌)在双方(客户端和服务器)之间传输，令牌在客户端识别时发出。对于每个后续请求，我们发送令牌。

而OAuth2是一个授权框架，它具有框架定义的一般过程和设置。JWT可以用作OAuth2中的一种机制。

你可以在这里阅读更多

OAuth还是JWT?使用哪一个，为什么?