For any web application or website, controlling user access is very important. Generally, there are 2 important ways to authenticate users, they are – Token-based and Cookie-based Authentication.
In this article, we will see about Token-based and Cookie-based Authentication and the basic flow.
Types of Authentications
Cookie Based Authentication
It is a stateful authentication mechanism. That means that the server needs to track active sessions while a Cookie is created in Front-end. It uses a user id and password to validate the users.
Cookie-Based Auth flow
- Enter user id and password
- The server verifies the details from the DB.
- If successful, then place a cookie with the session ID on the user’s browser
- On subsequent requests, the session ID is verified against the DB and if it is valid then the request is processed.
- On logout, the client and the server both will destroy the session.
Where to use Cookie-Based Authentication?
Prior to implementing any authentication technique, we need to ensure that this strategy is suitable per the nature, behaviour and design of our application.
- Cookie-based authentication is not suitable for APIs.
- Best suited for the single-domain application.
Advantages of Cookie-Based Application
- Cookie-based authentication helps to build stateful applications.
- It is stored in the client’s browser, so they help to improve user experience.
- Cookie-based authentication helps to protect against XSS attacks (Cross-Site Scripting).
Token Based Authentication
Each and every request to the servers is tied with a token which is used to verify the authenticity of the request. And this is the reason it is a stateless way of Authentication.
Token-based auth uses JWT (JSON web Token). It uses tokens to validate the users.
For eg – On many websites, we do signup/ sign in with Facebook, Google etc where the user is redirected to Facebook or Google to enter his credential there and on successful login, it redirects to the origin website with a Token to validate.
Token-Based Auth Flow
- Enter the credential
- The server verifies the credentials
- The token is stored on the client side.
- Subsequent requests to the server include this token.
- The server decodes the JWT and if the token is valid, it processes the request
- On logout, the token is destroyed.
About Token-based Authentication
Token-based is the stateless approach to authentication. For APIs, token-based authentication is the best option.
It stores data in JWT which may contain any type of data.
Conclusion
Authentications enhance application security by giving authenticated clients admittance to safeguarded assets.
In this article, we analyzed cookie-based authentication and token-based authentication. We featured the benefits and uses that emerge by picking both of these methodologies.
