All of the features of the previous apps were accessible to everyone that could create an HTTP connection with our server. Usually, a web app should behave differently depending on who is currently using it. Typically, some users are authorized to carry out some important operations, such as adding or updating records, while other users are authorized only to read these records. Sometimes, user-specific data must be recorded.
This opens up the vast world of authentication, authorization, and security.
Let's imagine a simplified scenario. There are two users whose profiles are wired-in to the mock database:
- joe, whose password is xjoe, can only read the database of people.
- susan, whose password is xsusan, can read and write the database of people—that is, she can do what the app in the previous section allowed.
The application starts with a login page. If the user does not insert an existing username and its matching password, they...
