Understanding modern authentication and authorization

Authentication and authorization are two different concepts that are often confused. Authentication involves confirming the identity of a user, whereas authorization involves verifying the specific access privileges they possess. In this chapter, we will explore how to implement both concepts in our web application in the Adding authentication and authorization to our web application section.

Authentication

One of the big challenges of the HTTP protocol is that it is stateless. This means that the server does not keep any information about the client. Each request is independent, so we need to design and provide mechanisms that allow us to know who the user performing the request is. This is the main goal of the authentication process.

There are many ways to implement authentication in a web application. The most common way is to use a username and password, and there are many libraries that can help us to implement this...