So in this section of the course, we're going to implement some authentication and there are lots of
different ways to do this.
So if you think about it, when we log a user in, something has to happen.
We have to authenticate that that user is valid, that they're active, that they have permissions,
whatever it may be.
So how authentication works varies depending on the kind of Web application we're talking about.
So for a website that has log in and doesn't have an API, for example, we actually can use sessions,
will allow the user to fill out a login form, will have some handler that validates the username and
password and decides whether or not that person can log in if that person can log in.
We typically set some kind of sessional variable like authenticated is equal to true or whatever the
case may be.
And then until that session expires or the user logs out, they can just do whatever they want.
So we validate that central variable on every request.
With the backend, it's a little bit different.
Typically, we use tokens and there are lots of different kinds of tokens that we can use.
So let's have a look at a few of them.
These are the major ones.
We have HDB basic authentication, which is really, really simple to implement and it's relatively
secure, but it's typically very, very slow.
The big advantage, of course, is that you don't have to do a lot of programming, but typically it's
not an ideal solution.
If you're going to have any amount of traffic whatsoever, then we have simple tokens.
We have a token that just is valid.
We validate whether or not the token is valid on the back end with every request to the back end.
And the difficulty with this one is that you have to validate the token.
You have to decide when it expires.
There's a fair bit of programming required to make that happen, and that's typically not very common
in my experience.
I've seen it, but I see other forms of authentication much more frequently than we have stateful tokens.
And these are tokens that we actually validate the user.
We typically store the validation, the token or a hash of the token and an expiry date in the database.
And we can manage the tokens that are valid any time we want to.
If we want to, for example, invalidate a given user, we simply remove that entry from the database
or we market has expired.
And the next time they make a request, they can't do anything.
Then we have one that has a lot of mindshare, JSON, Web tokens, JWT and they are stateless tokens,
the token and it's expire actually stored in the token itself.
A lot of people are using JSON Web tokens these days and in fact I've used it in another course and
they work reasonably well.
The big disadvantage is that you can't revoke a token on a per token basis.
If, for example, you have some user that's gone rogue, the only way to ensure that you get that user
off the system instantly is to revoke all of the tokens all at once.
And that's not an ideal situation.
And the other problem with JWT is, in my experience, is that it takes an awful lot of client side
programming to refresh the token when necessary, to validate the token.
And it's a lot of work, but it works really well and I've used them in the past.
Then we have API keys.
And if you've ever worked with GitHub APIs or something like that, you're probably familiar with it
and we're not going to do that one.
But it's something that exists in the same way off to you can authenticate a user using their Google
account or their Facebook account.
And that's got a lot of popularity.
But of course, the user has to have an account on that system.
The one we're going to use in this course is stateful tokens.
And it's a pretty straightforward approach.
It works really well.
And that's what we'll be doing in the coming lecture's.