WEB AUTHENTICATION 101 — Full Breakdown | by Harshana | Medium

Authorization is about what the user can do. “Now that I know who you are, what are you allowed to access?” Examples: First: Authentication → Then: Authorization 5. On every request, browser sends that cookie → server checks it → grants access 3. JWT is signed with a secret and sent to client 4. Client stores it (e.g., localStorage, cookie) 5. On every request, client sends it in Authorization header: 6. Server verifies signature and trusts the payload In JWT-based authentication, the server issues tokens (JSON Web Tokens) to the client after successful login. These tokens are used to authenticate the user for subsequent requests. Access Token : Refresh Token : 1.User logs in → Server issues: 2. Client sends the access token with each request to access protected resources. 3. When the access token expires, the client sends the refresh token to the server to get a new access token. 4. If the refresh token also expires, the user must log in again. In session-based authentication, the ser

saved by

• Lawrence H