State and browser security
Sessions and bearer tokens
Compare server-side sessions with bearer-token authentication and understand how each credential is carried and verified.
8 minute lesson
With a server-side session, the server stores session data and gives the browser an identifier, usually in a cookie. Each request sends that ID so the server can find the session.
A bearer token is often sent explicitly:
Authorization: Bearer eyJhbGciOi...The server verifies the token and determines what the caller may do. A token can contain signed claims or be an opaque reference to server-side data.
“Bearer” means possession is enough to use it. Protect session IDs and tokens like passwords. Use HTTPS, avoid placing them in URLs, limit their lifetime and permissions, and provide a way to revoke or rotate them.
Authentication proves who is making the request. Authorization decides whether that identity may perform the requested action.
Lesson completed