Introduction to Authentication Strategies

How does a server know that a request for /profile comes from the same person who logged in a second earlier? HTTP does not remember anything between requests, so every request arrives as if from a stranger. Checking who sent a request is called authentication. Deciding what that person may do afterward is a separate step, called authorization.

This chapter uses one small account app as its running example. A user named alice logs in once and then opens her profile page many times. The strategies below differ in one main way: where the proof of that login lives between her requests.