How this gem is different from a JWT system?

[rdupz]

I'm a bit confuse about the design of this authentication system.

• Is this using JWT under the hood?
• Why the token should be change at every request (from a security point of view)?
• Why the token (a hash of it) is stored in the database?

[lynndylanhurley]

Is this using JWT under the hood?

No.

Why the token should be change at every request (from a security point of view)?

The longer a token is valid, the longer an attacker has to exploit it. But you can disable this feature if you want.

Why the token (a hash of it) is stored in the database?

The user's access may be revoked or changed between requests. So we must check with the DB on each request. The tokens are hashed for the same reason that passwords are hashed.