Welcome to another type of authentication and that is session based authentication where what is session
based authentication and what is the difference between cookie based authentication and session based
authentication?
When talking about the security, why session based authentication is more secured than cookie based
authentication, cookie is not all that secure simply because we are saving the user details on the
browser which is not secured but for session.
We are going to save the user details on the server.
So let's read more about session based authentication.
So what is session?
Session simply means is a cookie that is stored on the server.
So if a cookie is being stored on the browser, it is called What's Cookies in the picture down here
explained what is a session?
In layman's understanding of a session, it simply means that doing something at some point in time.
So in your case, this is a session meaning we are going to save this user or this session on the server.
And if you serve the same user in the browser, it is called cookies.
So let's see how session authentication works.
I advise you to take some note as you proceed, because this table is really important for you to understand
authentication.
And if you go to token based authentication, the flow is going to be the same.
So let's move step by step.
Step number one is that when a user log in with login credentials, the next step is that the server
verify the details as we have discussed before how logging works.
So as soon as a user logs in their server is going to verify the details.
So if everything is correct, then the server is going to create a temporary user core session.
So as soon as you look in with the right details, the server is going to create a temporary user core
session.
So after the server has created a temporary user core session, the next step is that the server is
going to issue cookie with session ID.
And from there it is going to send the cookie with each request.
This means that when a user is trying to make a request, the user is going to send the cookie along
before the person can make a request.
And again, after that, the server is going to validate it against the session stored on the server.
So any time a user is trying to make a request, the user will send the cookie sent to him or her,
and then the server would take the cookie and then validate against the one that has been stored on
the server.
And if everything goes on, well, then the server will not allow or authorize the user to take any
action in the application.
The downside about session is that when a user logs out, the server destroys the session and clear
the cookies.
So it means that any time you look out or even we shut down our server, the session lost unless we
log in again and you find a way to avoid that.
So in the differences between session authentication and cookie based authentication is that for cookies,
cookies are being stored on the browser only, but for a session the cookies are being stored on the
server and on every request the user will send the cookie along and then the server is going to check.
Is it this cookie that I gave it to you?
If it is, yes, then you can go ahead and do whatever you want in the application.
And this is what is called authorization.
Let's use this diagram to explain more about how session works.
Let's take it that we have our application that we have developed and a user already has an account
with us and the user is trying to log in and create, post or do whatever he or she wants.
So let's see the flow.
So this is our server.
Then the first step is the user will enter his or her login details and then the details will be sent
to the server.
So first step is that the server is going to check if as a user by name, this username.
If there is one, then the server is going to create a session or cookies and save it on the server.
And then the server is going to send the same cookies and give it to the user and save it on the browser.
So upon every request, the user need to send the cookies back to the server, and then the server is
going to compare the cookie the user is trying to send to the one that it was used to generate.
If everything is correct, then the user can go ahead and log in.
But if there is something wrong, meaning that somebody has tampered the cookies on the browser, it
means that it is not valid in that way.
You are not authorized to log in or take any action.
But if everything is correct, then you are authorized to take any action or access any resources on
our server.
So this is how session works in the next video.
Let's see how we can implement this logic.