Authentication and Authorization

 Web Authentication Methods:

  • HTTP Basic Authentication
  • HTTP Digest Authentication
  • Session-based Auth
  • Token-Based Authentication
  • One Time Passwords
  • OAuth and OpenID

Detailed blog: here and video here(Tested with Postman)

HTTP is a stateless protocol.So you need to store state using session(cookies) or tokens.
Using Sessions the state is stored in the server side and sent to the clinet in response header.So when client want to talks to the server then again this session information needed to be sent using cookies.
It work fine for smal applications which are hosted on single host, but when your appliation is large and requires a load balancing solution we need to store that session information in common location eg:Redis.
In order to avaoid this, JWT token info in the client side only.So there is no overhead of maintaining state information on the server side


JWT:(JSON Web Token)

* Best video on internet: video1, what is JWT and why we need it
* Diff between  Sessions Cookes and JWT tokens, read here(vvvv IMP)

* JWT structure video2

OAUTH:

* best video: here, terminology and flow video here
Blog on Oauth2: here


API Authentication types:

  1. HTTP Authentication Schemes (Basic & Bearer)
  2. API Keys
  3. OAuth (2.0)
  4. OpenID Connect
    Details of 4 in detail: here

  • Bearer token was initially used in Oauth2.0 (Last step after 8 in pic). Later this concept was individually used(We can create token after login into application eg: Github and artifactory etc)
    More details: here


  • Nice video: here



Comments

Post a Comment

Popular posts from this blog

Docker Imp points

  1. docker run -it <image> <any command like ls>  - It will start the container execute the command and stop the container.The status of the stopped container can be seen using docker ps -a 2. docker run -it --rm <image> <any command like ls> - It will do the same the same hing, but after stopping it will also kills the container 3. If we run an docker image without specifying -d(detached mode),then we will enter into container directly and if we exit the container will be stopped 4.If we run container in detached mode by specifying -d,as shown below image will run in background,we can connect to it using exec. Eg:$docker run -itd <image> 5. About user in docker file: - If we specify any user in dockerfile, all the commands will be executed by that user and in  the image that user is retained, i.e if you make a container out of it,we will get same user. - If we want to switch user,you can do so using another user instruction in docker file a...
Read more

Docker volumes backup and restore & Docker networks

 Backup and restore docker volumes Official link Youtube Best aricle for volumes backup and restoration Docker neworks: Network drivers: Network driver summary : Bridge network Official link : The default network used by docker if we do not specify any option is bridge network We can create our own bridge network, Containers on the default bridge network can only access each other by IP addresses, unless you use the --link option , which is considered legacy. On a user-defined bridge network, containers can resolve each other by name or alias. We can create bridge network as shown below      $docker network create <network name>   If we don't specify any network driver then by default it is bridge and we can define subnet and default gateways by using different flagsf we can add container to user defined network 2 ways While creating docker container from image using --network or --net flag        $docker run --it --net=<network na...
Read more