Token-based authentication
The use of token-based authentication is widespread today. The idea is that whenever you log in to the API, you get an opaque token, a string that shouldn’t have any meaning for the client but has meaning for the server. For every subsequent request, you will send that token, and the server will check if that token is valid.
There are different models for token-based authentication. We are going to talk about two of them here: a server session token that associates a random token with the session information stored in the server, and the concept of JSON Web Token (JWT). In both cases, from the user perspective, the token should be an opaque code, something meaningless that only has meaning for the server. But let’s talk about each approach.
Server session token
The idea here is to generate a random string (a token) and store that string in the server, normally associated with a session, so that the client can send it inside every...
