Well we've had a couple of different videos on authentication and we've now established that we want
to go with fundamental option number two where we're going to make sure that each service understands
what authentication is and how to determine whether or not someone is logged in.
Now in all these different videos over here on the left hand side we've been saying that we were going
to have some requests to do something and the authentication mechanism was going to be a Jason web token
a cookie or something very similar.
So now in this video and the next couple we're going to establish exactly how we are going to prove
that a user is authenticated.
In other words are we using Jason web tokens or using cookies or what.
Well firstly I want to do is establish the difference between Jason Webb tokens and cookies.
I'm going to kind of assume that you're vaguely familiar with both these.
So I'm really just going to give you a quick reminder.
Most importantly biggest thing I want you to understand here.
The biggest thing I want you to recall is that Jason Webb tokens and cookies are not the same thing.
They are not equivalent by any stretch of the imagination.
Let's take a look at a series of diagrams and just get a quick reminder on what he cookie is and what
a Jason Webb token is and how they are similar in how they are different will first begin with cookies.
So we're going to imagine that we've got some browser making a request over to some server when the
server sends a response backwards the browser it can optionally include a header of set cookie and then
for that set cookie header it can provide some kind of value.
This value right here can be a string that contains any information that we want now a little piece
of information is then going to be automatically stored inside of the browser.
Then whenever this browser makes a follow up request to the same domain with the same port the browser
is going to make sure that it takes that little piece of information right there and appends it onto
the request as a cookie header.
So there's that little piece of information right there it'll be automatically sent over to the server.
The key things to understand here around this cookie approach or this idea of saving some cookie is
that at some arbitrary piece of information doesn't really matter what this information is is it can
be anything we possibly can think of that piece of information will be automatically stored by the browser
and automatically sent to the server.
Anytime we make a follow up request those are the key things to remember about cookies in general.
Now off to Jason web tokens remember with a Jason web token.
We're going to take some arbitrary piece of information that we refer to as the payload so this can
be some kind of object that has maybe a user I.D. a favorite color just about any information we can
possibly think of.
We're then going to take that payload and throw it into a js on web token creation algorithm.
It's then going to spit out our Jason Webb token.
It looks like an encoded string like this right here or some kind of token stored inside this thing.
Is that original payload.
We can very easily take that string right there throw it into some kind of decoding algorithm and extract
the original object.
So at any point time we can always access the information that is stored inside the token once we have
this token.
We eventually do need to communicate it between the browser and the server.
There are a couple of different methods so we can do or use to actually do this communication.
So whenever the browser makes requests the server is going to want to include that data on a Web token
in one way or another so that the browser can prove that it is authenticated or it is logged in with
this particular server to communicate that token over some very common approaches are to include an
authorization header that has the Jason Webb token inside of it.
We can just throw the entire token inside the body of a request assuming that it is a post request or
a put or a delete and so on or alternatively we can also kind of mix and match here and take that Jason
Webb token and store it inside of a cookie as well.
So the Jason Webb token will be managed automatically by the browser included on all follow up requests.
All right.
So just to recap what we have recovered or recalled inside this video.
Differences between cookies and Jason Webb tokens cookies are a transport mechanism.
They're a way of communicating information between the server and the browser and they do not necessarily
do anything loosely coupled to authorization.
We use them for authorization but that's not necessarily the primary purpose of the primary goal of
them.
It's not the only thing they can do we can use cookies to move any kind of data between the browser
and the server so it doesn't have to be authentication related stuff.
It can be tracking information.
It can be some kind of visit counter just about any kind of data we can easily store inside that cookie.
And then finally cookies are automatically managed by the browser.
You and I as developers specifically on the browser side of things don't really have to worry about
managing and managing them in any way shape or form.
All you and I have to do on the server is set a cookie and then we can be pretty much guaranteed that
will always come back in all full up requests Jason Webb tokens on the other hand are all about authentication
and authorization.
That is what they are intended to serve inside of a J somewhat token we can store any form or structure
of data that we want.
So it's traditionally going to be an object with some number of key value pairs and then Jason Webb
tokens have to be managed manually by you and I as developers on the front end unless we are storing
that Jason Webb token inside of a cookie all right.
So now that we've established difference between these again I just want you to recall that back inside
this diagram where we said well yeah our authentication thing is a Jason Webb token or a cookie.
It's kind of misleading to make these things sound equivalent because they are two very different things.
The cookie is just a transport mechanism.
It's something that's going to hold information.
It can be any kind of information.
It's not necessarily tied to authentication.
Jason will tokens on the other hand traditionally only use always used for authentication and authorization.
All right.
And we've established the difference here.
We need to take a deeper look at both these things and decide based on some pros and cons which one
is more appropriate or which approach or combination of the two is most appropriate for handling authentication
inside of a micro services architecture.
Let's take care of that in just a moment.