Authenticating our users
When it comes to authenticating our users, we have built a struct that extracts a message from the header of the HTTP request. We are now at the stage where we can make real use of this extraction by storing data about the user in the header. Right now, there is nothing stopping us from storing the username, ID, and password in the header of each HTTP request so that we can authenticate each one. However, this is a terrible practice. If someone intercepts the request or gets hold of the data stored in the browser to facilitate this, then the account is compromised and the hacker can do whatever they want. Instead, we are going to obfuscate the data, as shown in the following figure:
Figure 7.5 – Steps for authenticating requests
In Figure 7.5, we can see that we use a secret key to serialize the structured data that we have on the user into a token that is in bytes. We then give the token to the user to store in the browser...
