We can verify a user by firebase or by their email that saved to the database. But having these system why do we use JWT (json web token)? Is there any specific reason to use it?
Once you authenticate a user, you need to give back to the client some sort of token that indicates they are an authorized client so when the next request comes in, they can send just that token and not have to reauthenticate from scratch.
There are a number of ways to do that. You can create a session cookie (like when using express-session) or you can use a JWT which is a standardized type of token that is signed and can be verified or expired, etc... There's no requirement to use JWT specifically as the token technology. It's just one common, well-supported option.