Authentication and Authorization
We already have a new API exposing endpoints that accept requests and give responses. It can be sufficient for particular API cases, but you usually need some authentication and authorization. In this chapter, we are going to go through the following topics:
- Basic authentication
- Token-based authentication
- Authorization using the role-based access control (RBAC) approach
- Adding authentication to our API
- Adding authorization to our API
It is essential to have a clear understanding of what the difference is between authorization and authentication. Both features are related, but they have very different purposes. The authentication responsibility is to know the user and verify that the user is whoever they say they are. Authorization, on the other hand, uses authentication information (who the user is) to decide whether the user is allowed or not to execute specific actions. For example, you must authenticate...
