Learn the difference between session and token-based authentication on the web. Master Web Security in 12 weeks 👉 https://websecurity-academy.com/?aff=487495_h0fjhwrd Enroll before the deadline on 31st Oct (Saturday). 

#web #security #100SecondsOfCode
2024-02-04T06:03:27.802Z
nova-2
2-general-nova
2024-01-09.29447
30089e05-99d1-4376-b32e-c263170674af
7d3af5f2-e0f1-4784-9e2f-1d64cb87cfa2
268b4b1c3661467706effd44c3df6cfb1dee2e76be169474c51081d88bb572d9
67875a7f-c9c4-48a0-aa55-5bdb8a91c34a
deprecated
User authentication.
There are 2 main ways to get the job done, sessions and tokens.
The traditional approach on the web is cookie based server side sessions.
The process begins with a user filling out their username and password and then submitting it to a server, which then validates it, creates a session in the database, then responds with a session ID.
The session ID will be saved in the browser's cookie jar, which is a place in the browser to save key value pairs that will be sent back to the server on each subsequent quest.
It can then respond back with content designed for the currently logged in user.
In other words, we have a stateful session between the front end client and back end server.
This approach works great, but there are some drawbacks.
It can be vulnerable to an attack known as cross site request forgery, where the attacker points the user to a site they're logged into to perform actions they didn't intend to, like submitting a payment or changing their password.
Although, the risk is very low, especially if you use a modern framework to implement your code.
The bigger Problem is that you'll need to store the session ID in a database or keep it in memory on the server.
Because most of today's cloud applications are scaled horizontally, This can be a huge bottleneck in production.
And that brings us to token based authentication, which solves this problem, but introduces its own set of challenges.
The process begins the same with the client sending its login details to the server.
Instead of storing a session ID, it generates a JSON web token.
The JWT is created with private key on the server.
Then it's sent back to the browser where it's normally kept in local storage.
On future requests, the JWT will be added to the authorization header prefixed by bearer.
The server then only needs to validate the signature.
There's no need for a database lookup somewhere else in the infrastructure, and that's way more efficient when dealing with a distributed system in the cloud.
However, tokens can still be hijacked by an attacker, and they can also be difficult to invalidate, and they can't be used to authenticate a user in the background on the server.
Here's the most important thing to understand.
With a session, the authentication state is handled on the server, while tokens are managed on the client.
This has been user authentication in 100 seconds.
If you want to master web security, check out Web Security Academy.
My friend Bartos is launching a 12 week coaching program.
It's not your ordinary course, but 12 weeks of high value group based learning.
And I'm teaching my own module in the course on Firebase security.
Check out the link in the description to learn more, and I will see you there in a few weeks.
Thanks for watching.

Speaker 0: User authentication. There are 2 main ways to get the job done, sessions and tokens. The traditional approach on the web is cookie based server side sessions. The process begins with a user filling out their username and password and then submitting it to a server, which then validates it, creates a session in the database, then responds with a session ID. The session ID will be saved in the browser's cookie jar, which is a place in the browser to save key value pairs that will be sent back to the server on each subsequent quest.

It can then respond back with content designed for the currently logged in user. In other words, we have a stateful session between the front end client and back end server. This approach works great, but there are some drawbacks. It can be vulnerable to an attack known as cross site request forgery, where the attacker points the user to a site they're logged into to perform actions they didn't intend to, like submitting a payment or changing their password. Although, the risk is very low, especially if you use a modern framework to implement your code.

The bigger Problem is that you'll need to store the session ID in a database or keep it in memory on the server. Because most of today's cloud applications are scaled horizontally, This can be a huge bottleneck in production. And that brings us to token based authentication, which solves this problem, but introduces its own set of challenges. The process begins the same with the client sending its login details to the server. Instead of storing a session ID, it generates a JSON web token.

The JWT is created with private key on the server. Then it's sent back to the browser where it's normally kept in local storage. On future requests, the JWT will be added to the authorization header prefixed by bearer. The server then only needs to validate the signature. There's no need for a database lookup somewhere else in the infrastructure, and that's way more efficient when dealing with a distributed system in the cloud.

However, tokens can still be hijacked by an attacker, and they can also be difficult to invalidate, and they can't be used to authenticate a user in the background on the server. Here's the most important thing to understand. With a session, the authentication state is handled on the server, while tokens are managed on the client. This has been user authentication in 100 seconds. If you want to master web security, check out Web Security Academy.

My friend Bartos is launching a 12 week coaching program. It's not your ordinary course, but 12 weeks of high value group based learning. And I'm teaching my own module in the course on Firebase security. Check out the link in the description to learn more, and I will see you there in a few weeks. Thanks for watching.
User authentication. There are 2 main ways to get the job done, sessions and tokens. The traditional approach on the web is cookie based server side sessions. The process begins with a user filling out their username and password and then submitting it to a server, which then validates it, creates a session in the database, then responds with a session ID.
security
The session ID will be saved in the browser's cookie jar, which is a place in the browser to save key value pairs that will be sent back to the server on each subsequent quest. It can then respond back with content designed for the currently logged in user. In other words, we have a stateful session between the front end client and back end server. This approach works great, but there are some drawbacks. It can be vulnerable to an attack known as cross site request forgery, where the attacker points the user to a site they're logged into to perform actions they didn't intend to, like submitting a payment or changing their password.
Although, the risk is very low, especially if you use a modern framework to implement your code. The bigger Problem is that you'll need to store the session ID in a database or keep it in memory on the server. Because most of today's cloud applications are scaled horizontally, This can be a huge bottleneck in production.
databases
data management
And that brings us to token based authentication, which solves this problem, but introduces its own set of challenges. The process begins the same with the client sending its login details to the server. Instead of storing a session ID, it generates a JSON web token. The JWT is created with private key on the server. Then it's sent back to the browser where it's normally kept in local storage. On future requests, the JWT will be added to the authorization header prefixed by bearer.
The server then only needs to validate the signature. There's no need for a database lookup somewhere else in the infrastructure, and that's way more efficient when dealing with a distributed system in the cloud. However, tokens can still be hijacked by an attacker, and they can also be difficult to invalidate, and they can't be used to authenticate a user in the background on the server. Here's the most important thing to understand. With a session, the authentication state is handled on the server, while tokens are managed on the client. This has been user authentication in 100 seconds. If you want to master web security, check out Web Security Academy. My friend Bartos is launching a 12 week coaching program. It's not your ordinary course, but 12 weeks of high value group based learning. And I'm teaching my own module in the course on Firebase security. Check out the link in the description to learn more, and I will see you there in a few weeks. Thanks for watching.
security
cryptocurrency
databases
deep learning
teaching
User authentication. There are 2 main ways to get the job done, sessions and tokens. The traditional approach on the web is cookie based server side sessions. The process begins with a user filling out their username and password and then submitting it to a server, which then validates it, creates a session in the database, then responds with a session ID. The session ID will be saved in the browser's cookie jar, which is a place in the browser to save key value pairs that will be sent back to the server on each subsequent quest. It can then respond back with content designed for the currently logged in user. In other words, we have a stateful session between the front end client and back end server. This approach works great, but there are some drawbacks. It can be vulnerable to an attack known as cross site request forgery, where the attacker points the user to a site they're logged into to perform actions they didn't intend to, like submitting a payment or changing their password. Although, the risk is very low, especially if you use a modern framework to implement your code. The bigger Problem is that you'll need to store the session ID in a database or keep it in memory on the server. Because most of today's cloud applications are scaled horizontally, This can be a huge bottleneck in production. And that brings us to token based authentication, which solves this problem, but introduces its own set of challenges. The process begins the same with the client sending its login details to the server. Instead of storing a session ID, it generates a JSON web token. The JWT is created with private key on the server. Then it's sent back to the browser where it's normally kept in local storage. On future requests, the JWT will be added to the authorization header prefixed by bearer. The server then only needs to validate the signature. There's no need for a database lookup somewhere else in the infrastructure, and that's way more efficient when dealing with a distributed system in the cloud. However, tokens can still be hijacked by an attacker, and they can also be difficult to invalidate, and they can't be used to authenticate a user in the background on the server. Here's the most important thing to understand. With a session, the authentication state is handled on the server, while tokens are managed on the client. This has been user authentication in 100 seconds. If you want to master web security, check out Web Security Academy. My friend Bartos is launching a 12 week coaching program. It's not your ordinary course, but 12 weeks of high value group based learning. And I'm teaching my own module in the course on Firebase security. Check out the link in the description to learn more, and I will see you there in a few weeks. Thanks for watching.
User
user
authentication.
authentication
There
there
are
are
2
2
main
main
ways
ways
to
to
get
get
the
the
job
job
done,
done
sessions
sessions
and
and
tokens.
tokens
The
the
traditional
traditional
approach
approach
on
on
the
the
web
web
is
is
cookie
cookie
based
based
server
server
side
side
sessions.
sessions
The
the
process
process
begins
begins
with
with
a
a
user
user
filling
filling
out
out
their
their
username
username
and
and
password
password
and
and
then
then
submitting
submitting
it
it
to
to
a
a
server,
server
which
which
then
then
validates
validates
it,
it
creates
creates
a
a
session
session
in
in
the
the
database,
database
then
then
responds
responds
with
with
a
a
session
session
ID.
id
The
the
session
session
ID
id
will
will
be
be
saved
saved
in
in
the
the
browser's
browser's
cookie
cookie
jar,
jar
which
which
is
is
a
a
place
place
in
in
the
the
browser
browser
to
to
save
save
key
key
value
value
pairs
pairs
that
that
will
will
be
be
sent
sent
back
back
to
to
the
the
server
server
on
on
each
each
subsequent
subsequent
quest.
quest
It
it
can
can
then
then
respond
respond
back
back
with
with
content
content
designed
designed
for
for
the
the
currently
currently
logged
logged
in
in
user.
user
In
in
other
other
words,
words
we
we
have
have
a
a
stateful
stateful
session
session
between
between
the
the
front
front
end
end
client
client
and
and
back
back
end
end
server.
server
This
this
approach
approach
works
works
great,
great
but
but
there
there
are
are
some
some
drawbacks.
drawbacks
It
it
can
can
be
be
vulnerable
vulnerable
to
to
an
an
attack
attack
known
known
as
as
cross
cross
site
site
request
request
forgery,
forgery
where
where
the
the
attacker
attacker
points
points
the
the
user
user
to
to
a
a
site
site
they're
they're
logged
logged
into
into
to
to
perform
perform
actions
actions
they
they
didn't
didn't
intend
intend
to,
to
like
like
submitting
submitting
a
a
payment
payment
or
or
changing
changing
their
their
password.
password
Although,
although
the
the
risk
risk
is
is
very
very
low,
low
especially
especially
if
if
you
you
use
use
a
a
modern
modern
framework
framework
to
to
implement
implement
your
your
code.
code
The
the
bigger
bigger
Problem
problem
is
is
that
that
you'll
you'll
need
need
to
to
store
store
the
the
session
session
ID
id
in
in
a
a
database
database
or
or
keep
keep
it
it
in
in
memory
memory
on
on
the
the
server.
server
Because
because
most
most
of
of
today's
today's
cloud
cloud
applications
applications
are
are
scaled
scaled
horizontally,
horizontally
This
this
can
can
be
be
a
a
huge
huge
bottleneck
bottleneck
in
in
production.
production
And
and
that
that
brings
brings
us
us
to
to
token
token
based
based
authentication,
authentication
which
which
solves
solves
this
this
problem,
problem
but
but
introduces
introduces
its
its
own
own
set
set
of
of
challenges.
challenges
The
the
process
process
begins
begins
the
the
same
same
with
with
the
the
client
client
sending
sending
its
its
login
login
details
details
to
to
the
the
server.
server
Instead
instead
of
of
storing
storing
a
a
session
session
ID,
id
it
it
generates
generates
a
a
JSON
json
web
web
token.
token
The
the
JWT
jwt
is
is
created
created
with
with
private
private
key
key
on
on
the
the
server.
server
Then
then
it's
it's
sent
sent
back
back
to
to
the
the
browser
browser
where
where
it's
it's
normally
normally
kept
kept
in
in
local
local
storage.
storage
On
on
future
future
requests,
requests
the
the
JWT
jwt
will
will
be
be
added
added
to
to
the
the
authorization
authorization
header
header
prefixed
prefixed
by
by
bearer.
bearer
The
the
server
server
then
then
only
only
needs
needs
to
to
validate
validate
the
the
signature.
signature
There's
there's
no
no
need
need
for
for
a
a
database
database
lookup
lookup
somewhere
somewhere
else
else
in
in
the
the
infrastructure,
infrastructure
and
and
that's
that's
way
way
more
more
efficient
efficient
when
when
dealing
dealing
with
with
a
a
distributed
distributed
system
system
in
in
the
the
cloud.
cloud
However,
however
tokens
tokens
can
can
still
still
be
be
hijacked
hijacked
by
by
an
an
attacker,
attacker
and
and
they
they
can
can
also
also
be
be
difficult
difficult
to
to
invalidate,
invalidate
and
and
they
they
can't
can't
be
be
used
used
to
to
authenticate
authenticate
a
a
user
user
in
in
the
the
background
background
on
on
the
the
server.
server
Here's
here's
the
the
most
most
important
important
thing
thing
to
to
understand.
understand
With
with
a
a
session,
session
the
the
authentication
authentication
state
state
is
is
handled
handled
on
on
the
the
server,
server
while
while
tokens
tokens
are
are
managed
managed
on
on
the
the
client.
client
This
this
has
has
been
been
user
user
authentication
authentication
in
in
100
100
seconds.
seconds
If
if
you
you
want
want
to
to
master
master
web
web
security,
security
check
check
out
out
Web
web
Security
security
Academy.
academy
My
my
friend
friend
Bartos
bartos
is
is
launching
launching
a
a
12
12
week
week
coaching
coaching
program.
program
It's
it's
not
not
your
your
ordinary
ordinary
course,
course
but
but
12
12
weeks
weeks
of
of
high
high
value
value
group
group
based
based
learning.
learning
And
and
I'm
i'm
teaching
teaching
my
my
own
own
module
module
in
in
the
the
course
course
on
on
Firebase
firebase
security.
security
Check
check
out
out
the
the
link
link
in
in
the
the
description
description
to
to
learn
learn
more,
more
and
and
I
i
will
will
see
see
you
you
there
there
in
in
a
a
few
few
weeks.
weeks
Thanks
thanks
for
for
watching.
watching
success
The speaker discusses two main ways to secure a job, which involves filling out a username and password and submitting it to a server, creating a session in the database, and responding with a session ID. The process can be vulnerable to attacks and is time consuming, although it is efficient for cloud applications. tokens can still be hijacked by grandmotheralenaes and are difficult to authenticate. A coaching program is offered for 12 weeks, and the speaker will see you soon.
Session vs Token Authentication in 100 Seconds
User authentication. There are 2 main ways to get the job done, sessions and tokens. The traditional approach on the web is cookie based server side sessions. The process begins with a user filling out their username and password and then submitting it to a server, which then validates it, creates a session in the database, then responds with a session ID. The session ID will be saved in the browser's cookie jar, which is a place in the browser to save key value pairs that will be sent back to the server on each subsequent quest. It can then respond back with content designed for the currently logged in user. In other words, we have a stateful session between the front end client and back end server. This approach works great, but there are some drawbacks. It can be vulnerable to an attack known as cross site request forgery, where the attacker points the user to a site they're logged into to perform actions they didn't intend to, like submitting a payment or changing their password. Although, the risk is very low, especially if you use a modern framework to implement your code. The bigger Problem is that you'll need to store the session ID in a database or keep it in memory on the server. Because most of today's cloud applications are scaled horizontally, This can be a huge bottleneck in production. And that brings us to token based authentication, which solves this problem, but introduces its own set of challenges. The process begins the same with the client sending its login details to the server. Instead of storing a session ID, it generates a JSON web token. The JWT is created with private key on the server. Then it's sent back to the browser where it's normally kept in local storage. On future requests, the JWT will be added to the authorization header prefixed by bearer. The server then only needs to validate the signature. There's no need for a database lookup somewhere else in the infrastructure, and that's way more efficient when dealing with a distributed system in the cloud. However, tokens can still be hijacked by an attacker, and they can also be difficult to invalidate, and they can't be used to authenticate a user in the background on the server. Here's the most important thing to understand. With a session, the authentication state is handled on the server, while tokens are managed on the client. This has been user authentication in 100 seconds. If you want to master web security, check out Web Security Academy. My friend Bartos is launching a 12 week coaching program. It's not your ordinary course, but 12 weeks of high value group based learning. And I'm teaching my own module in the course on Firebase security. Check out the link in the description to learn more, and I will see you there in a few weeks. Thanks for watching.
The speaker discusses two main ways to secure a job, which involves filling out a username and password and submitting it to a server, creating a session in the database, and responding with a session ID. The process can be vulnerable to attacks and is time consuming, although it is efficient for cloud applications. tokens can still be hijacked by grandmotheralenaes and are difficult to authenticate. A coaching program is offered for 12 weeks, and the speaker will see you soon.