While JWT is not a part of Java EE or the MicroProfile, it has become a de facto for token-based authentications. RESTful services, being stateless, require dealing with security with each request. So, clients typically would be sending some form of a token along with each request. This allows the API to create the needed security context for the caller and perform role-based checks as needed. As token-based authentication is widely adopted and standards such as OpenID Connect and OAuth2.0 are also token-based, it makes sense to get the approach standardized.
There is also a proposal to include JWT Role Based Access (JWT RBAC) for MicroProfile, so in the near future, we may see this get adopted as a standard. This would allow for working with authentication and authorization policies using tokens in a standard manner. The strategy...
