1
00:00:08,490 --> 00:00:19,920
Welcome to another type of authentication and that is session based authentication where what is session

2
00:00:19,920 --> 00:00:27,180
based authentication and what is the difference between cookie based authentication and session based

3
00:00:27,180 --> 00:00:28,470
authentication?

4
00:00:29,010 --> 00:00:36,930
When talking about the security, why session based authentication is more secured than cookie based

5
00:00:36,930 --> 00:00:45,330
authentication, cookie is not all that secure simply because we are saving the user details on the

6
00:00:45,330 --> 00:00:49,440
browser which is not secured but for session.

7
00:00:49,440 --> 00:00:53,670
We are going to save the user details on the server.

8
00:00:53,700 --> 00:00:58,590
So let's read more about session based authentication.

9
00:00:58,710 --> 00:01:00,750
So what is session?

10
00:01:00,990 --> 00:01:06,390
Session simply means is a cookie that is stored on the server.

11
00:01:06,870 --> 00:01:15,120
So if a cookie is being stored on the browser, it is called What's Cookies in the picture down here

12
00:01:15,150 --> 00:01:17,850
explained what is a session?

13
00:01:18,090 --> 00:01:25,710
In layman's understanding of a session, it simply means that doing something at some point in time.

14
00:01:25,830 --> 00:01:34,140
So in your case, this is a session meaning we are going to save this user or this session on the server.

15
00:01:34,380 --> 00:01:38,820
And if you serve the same user in the browser, it is called cookies.

16
00:01:38,820 --> 00:01:43,770
So let's see how session authentication works.

17
00:01:43,920 --> 00:01:51,810
I advise you to take some note as you proceed, because this table is really important for you to understand

18
00:01:51,810 --> 00:01:53,100
authentication.

19
00:01:53,250 --> 00:01:58,590
And if you go to token based authentication, the flow is going to be the same.

20
00:01:58,590 --> 00:02:01,470
So let's move step by step.

21
00:02:01,950 --> 00:02:11,400
Step number one is that when a user log in with login credentials, the next step is that the server

22
00:02:11,400 --> 00:02:17,790
verify the details as we have discussed before how logging works.

23
00:02:17,940 --> 00:02:23,340
So as soon as a user logs in their server is going to verify the details.

24
00:02:23,340 --> 00:02:31,860
So if everything is correct, then the server is going to create a temporary user core session.

25
00:02:32,520 --> 00:02:39,040
So as soon as you look in with the right details, the server is going to create a temporary user core

26
00:02:39,060 --> 00:02:39,930
session.

27
00:02:40,380 --> 00:02:47,760
So after the server has created a temporary user core session, the next step is that the server is

28
00:02:47,760 --> 00:02:51,810
going to issue cookie with session ID.

29
00:02:52,110 --> 00:02:57,990
And from there it is going to send the cookie with each request.

30
00:02:58,020 --> 00:03:05,490
This means that when a user is trying to make a request, the user is going to send the cookie along

31
00:03:05,490 --> 00:03:08,040
before the person can make a request.

32
00:03:08,280 --> 00:03:16,410
And again, after that, the server is going to validate it against the session stored on the server.

33
00:03:16,830 --> 00:03:24,360
So any time a user is trying to make a request, the user will send the cookie sent to him or her,

34
00:03:24,390 --> 00:03:30,930
and then the server would take the cookie and then validate against the one that has been stored on

35
00:03:30,930 --> 00:03:31,650
the server.

36
00:03:32,130 --> 00:03:40,020
And if everything goes on, well, then the server will not allow or authorize the user to take any

37
00:03:40,020 --> 00:03:42,000
action in the application.

38
00:03:42,540 --> 00:03:51,740
The downside about session is that when a user logs out, the server destroys the session and clear

39
00:03:51,750 --> 00:03:52,830
the cookies.

40
00:03:53,100 --> 00:04:01,650
So it means that any time you look out or even we shut down our server, the session lost unless we

41
00:04:01,650 --> 00:04:06,300
log in again and you find a way to avoid that.

42
00:04:06,330 --> 00:04:13,230
So in the differences between session authentication and cookie based authentication is that for cookies,

43
00:04:13,230 --> 00:04:19,649
cookies are being stored on the browser only, but for a session the cookies are being stored on the

44
00:04:19,649 --> 00:04:26,490
server and on every request the user will send the cookie along and then the server is going to check.

45
00:04:26,640 --> 00:04:28,920
Is it this cookie that I gave it to you?

46
00:04:28,950 --> 00:04:33,840
If it is, yes, then you can go ahead and do whatever you want in the application.

47
00:04:33,930 --> 00:04:36,480
And this is what is called authorization.

48
00:04:36,870 --> 00:04:42,720
Let's use this diagram to explain more about how session works.

49
00:04:42,930 --> 00:04:49,530
Let's take it that we have our application that we have developed and a user already has an account

50
00:04:49,530 --> 00:04:55,420
with us and the user is trying to log in and create, post or do whatever he or she wants.

51
00:04:55,440 --> 00:04:56,850
So let's see the flow.

52
00:04:56,880 --> 00:04:58,980
So this is our server.

53
00:04:59,010 --> 00:05:07,140
Then the first step is the user will enter his or her login details and then the details will be sent

54
00:05:07,140 --> 00:05:08,400
to the server.

55
00:05:08,580 --> 00:05:15,510
So first step is that the server is going to check if as a user by name, this username.

56
00:05:15,900 --> 00:05:24,210
If there is one, then the server is going to create a session or cookies and save it on the server.

57
00:05:24,450 --> 00:05:33,660
And then the server is going to send the same cookies and give it to the user and save it on the browser.

58
00:05:33,720 --> 00:05:42,330
So upon every request, the user need to send the cookies back to the server, and then the server is

59
00:05:42,330 --> 00:05:49,620
going to compare the cookie the user is trying to send to the one that it was used to generate.

60
00:05:49,830 --> 00:05:53,750
If everything is correct, then the user can go ahead and log in.

61
00:05:53,760 --> 00:06:00,600
But if there is something wrong, meaning that somebody has tampered the cookies on the browser, it

62
00:06:00,600 --> 00:06:03,750
means that it is not valid in that way.

63
00:06:03,780 --> 00:06:08,430
You are not authorized to log in or take any action.

64
00:06:08,670 --> 00:06:16,260
But if everything is correct, then you are authorized to take any action or access any resources on

65
00:06:16,260 --> 00:06:17,140
our server.

66
00:06:17,160 --> 00:06:21,170
So this is how session works in the next video.

67
00:06:21,180 --> 00:06:23,640
Let's see how we can implement this logic.