- User Requests Access with Username / Password
- Application validates credentials
- Application provides a signed token to the client
- Client stores that token and sends it along with every request
Every SIngle request after the first will require the token. This token should be sent in the HTTP header so that we keep with the idea of stateless HTPP requests. We will also need to set our server to accept requests from all domains using Access-Control-Allow-Origin: *
Benefits
Stateless and Scalable
No information is stored in server
Security
The token is sent on every request and since there is no cookie being sent, this helps to prevent CSRF attacks. The token also expires after a set amount of time.
Extensibility
Tokens will allow us to build applications that share permissions with another.
Multiple platforms and domains
CORS
JSON Web Tokens
The third part is Signature which is made up of a hash of following
- the header
- the payload
- secret