Why not Basic Auth everytime instead JWT?

Question

I'm in the middle of writing a RESTFUL API in Hapi, I could not figure out API authentication methodologies.

Assuming we're using SSL/TLS with HTTP/1.1, why do we need something like JSON Web Token (JWT), where we already have HTTP Basic Authentication. We may protect every endpoint with HTTP Basic Auth, so we wouldn't even need login routes like '/login'.

So, what's the point of those authentication schemes, OAuth's and JWT?

Thank you.

Answer 1

OAuth and JWT use tokens, not passwords. Tokens are uniquely generated per application and site. If someone steals a token, they have not stolen your password, and that token is only good for that session only.

Contrast this with basic auth, it's an actual user password. Not only can they re-use that password whenever they want, they can also use that password with any other service that uses the same password. Stealing a token doesn't allow that to work.