You log into a website. How does that site remember who you are on the next page? Or even tomorrow? This isn't magic. It's done through Authentication Mechanisms, primarily Session-based or Token-based (JWT).
πͺ 1. Traditional: Session-based Authentication
This is the older, but still common, way. Think of it like a coat check.
β’ How it Works:
1. You log in with username/password.
2. The server creates a "session" for you (a record stored in its memory or database).
3. The server sends you back a Session ID (a small, unique string) in a cookie.
4. For every subsequent request, your browser sends that Session ID cookie back to the server.
5. The server looks up the Session ID in its storage to know who you are.
π« 2. Modern: Token-based Authentication (JWT)
This is the approach favored by modern APIs and single-page applications (SPAs). Think of it like a concert ticket with your info embedded.
β’ How it Works:
1. You log in with username/password.
2. The server generates a Token (often a JSON Web Token - JWT). This token contains encrypted user data (like user ID, roles, expiry time) but the server does not store it.
3. The server sends this JWT back to your client (browser/mobile app).
4. Your client stores the JWT (e.g., in Local Storage, memory, or a secure cookie).
5. For every subsequent request, your client sends the JWT in an
Authorization header (Bearer YOUR_JWT_TOKEN).6. The server decodes and verifies the JWT using a secret key. If valid, it trusts the token's claims about who you are.
π― Today's Goal (What you should do)
βοΈ Understand that "Session-based" means the server stores your login status.
βοΈ Grasp that "Token-based" means the client sends a verifiable token, and the server checks it on the fly.
βοΈ Know when to choose each for your application architecture.