Authenticating our users
Authenticating our users is a straightforward goal. We want to take the credentials that the user gives us, check them, and then return a true or false regarding whether the user can perform actions based on this. A straightforward way to do this is to constantly include our username and password in our requests. However, this is not safe. If the request is intercepted, then our credentials can be obtained. There is also the risk of internal attackers who might not be able to access the database to directly edit records, though this could be monitoring the server for a limited amount of time. We do not want passwords to be directly available when requests are made. Another thing we have to take into account is that we do not want our user to be typing in their password for every request. Therefore, we are going to have to store their credentials in either the user's browser or cookies. If these are breached, then the attacker has access to the user&apos...
