Summary
In this chapter, I demonstrated how users and requests can be authenticated, and how authentication data can be used to authorize access to application features:
- Users present their credentials, whether using an HTML form or a JSON payload.
- When credentials are validated, the client is sent a temporary token that can be used to authenticate subsequent requests.
- The temporary authentication token can be a cookie (and a session cookie is often used) or a bearer token.
- Authorization is usually performed through roles, which prevents you having to hardcode user permissions into the application. The relationship between users and roles is stored in a database, so it can be altered without releasing a new version of the application.
- There are good open-source packages available for user and request authentication, but authorization is typically done using custom code.
In Part 3, I use the features described in Parts 1 and 2 of this book...
