anchor.diff:  
   ==== Overview
   
  -Gentics Mesh currently supports multiple ways of authentication.
  -You can login via:
  -
  -* sending Basic Authentication header 
  -* sending JSON Data 
  -* sending a JWT token
  -
  -Each way will store a JWT in the cookie which is used to authenticate the user for succeeding requests.
  -
  -The token only lasts a certain amount of time (which can be configured in the `mesh.yml` file), so it might be necessary to refresh the token. 
  -The JWT will be automatically renewed by every request on the Gentics Mesh API. Additionally it is also possible to manually refresh the token using a GET request on the `/api/v1/auth/refresh` endpoint.
  -This will set create new token which has a refreshed expire time.
  +In order to be able to store and retrieve content, a Gentics Mesh user needs to authenticate (`username:password`). Gentics Mesh provides multiple ways of authentication:
  +
  +* using basic authentication header
  +* posting JSON Data
  +* sending a valid JSON Web token (JWT)
  +
  +Each way will store a JWT in a cookie which is used to authenticate the user for succeeding requests. The token only lasts a certain amount of time (which can be configured in the `mesh.yml` file), so it might be necessary to refresh the token. The JWT will be automatically renewed with every request on the Gentics Mesh API. 
  +
  +NOTE: Currently, all data including media assets such as images, videos, and documents are secured and need authentication to be retrieved.
   
   ===== JWT Configuration
  -
  -The _Json Web Token_ store can be configured within the main `mesh.yml` config file.
  -
  -You also have to set the keystore secret and the path to the keystore file. See above for an example.
  -
  -Before using JWT you have to create a keystore which holds the secret to generate the signature for the token.
  -Currently only the HS256 algorithm is supported. You can use the java `keytool` to create a new keystore.
  -
  -Here is an example on how to create a keystore:
  -
  -[source,bash]
  -----
  -keytool -genseckey -keystore keystore.jceks -storetype jceks -storepass secret -keyalg HMacSHA256 -keysize 2048 -alias HS256 -keypass secret
  -----
  -
  -After creating the keystore, set the file path of the keystore and the password to access the keystore in the `mesh.yml` configuration file.
  -
  -Example:
  +The JWT auth provider requires a keystore for signing and verifying the generated tokens. 
  +It can be configured within the `mesh.yml` configuration file. 
   
   [source,bash]
   ----
  
positive.code:   tokenExpirationTime: 3600
    keystorePassword: "secret"
    keystorePath: "keystore.jceks"
  ----
  
  ===== Basic Auth
  
  A user can be authenticated by invoking a regular GET request to `/api/v1/auth/login` which includes a http://tools.ietf.org/html/rfc1945#section-11.1[[Basic Authentication HTTP header].
  
  ===== Json Web Token (JWT)
  
  The JWT token can be provided in two ways. By default it is passed along with a cookie value. This is useful for embedding binary image nodes directly in HTML.
  
  Alternativly the token can be passed along within the `Authorization` header which includes the regular JWT `"Bearer <Token>"`, where `<Token>` is the token you received from the login/cookie.
  
  ===== JSON
  
  Alternatively the user can POST his credentials to `/api/v1/auth/login` in order to retrieve a token.
  
  The JSON object must containing these fields:
  
  * `username` The username of the user
  * `password` The password of the user
  
  If the authentication was successful, the server will respond with a JSON object containing a single field:
  
  * `token` The token to be sent on every subsequent request.
  
  Additionally the token will also be provided via a cookie.
  
  === Encoding
  
  
negative.code: == License
  
  * Gentics Mesh is published under a commercial license. http://getmesh.io/Terms[License Terms]
  * https://github.com/graphql/graphiql[GraphiQL] is owned and developed by Facebook Inc.