Bearer Authorization - 401-advanced-javascript-billybunn/seattle-javascript-401d29 GitHub Wiki

Definitions recap

  • encoding: Transforming data into another format using a a publicly available scheme so that some computer can properly read the data. Think of encoding plain text into binary data, base64, ascii, url encoding, unicode, etc. Encoded data can be decoded by anyone.
  • encryption: Transforming data to keep it secret from others by using a secret key. If you have the encryption algorithm and the key, you can reverse the encryption and see the data in plain text.
  • hashing: Transforming data into another fixed-length string. The same input always produces the same output. Hashing cannot be undone. Think of hashing passwords before you store them in a database so there's never any plain text stored; whenever a user logs in, their input is hashed the same way and matched with the hashed password in the database.

Basic Authorization

So far we've learned that Basic authentication involves sending user credentials (ID and password) over the network in a post request. Usually these credentials are just base64 encoded, but that still leaves them vulnerable—encoding transforms the data in a way that can be reversed by anyone.

So with Basic, we send username:password base64 encoded in the HTTP Authorization header.

Authorization: Basic a;ldkjqpo9u44lkjalk

Bearer Authorization

Bearer authorization also uses data sent in the Authorization header, but this time uses a token instead of encoded ID/password info.

Authorization: Bearer ds;alkfja;dlkmjka

A token is like a physical key. Anyone can use the key to unlock a lock; the lock doesn't care who's using it, just that it's the right key. These keys can be passed between people so different people can unlock the same lock.

Similarly, tokens can give certain access to any computer/server who holds them (uses them in in the header of a HTTP request), like signing in to a website. The service you're signing into doesn't care who you are, just that your request has a valid token (key).

JWT stands for JSON Web Token, which is a specific type of token and widely used. JWTs are self-describing and have a 3-part structure: header, body, & signature. The bearer token article linked below puts it this way:

The header describes how to interpret the rest of the token, hence the self-describing property. The body contains JSON data, and the signature provides integrity for the header and the body. This structure allows the authenticating service to operate without state as everything needed to interpret the token is encoded inside it.

In general, being self-descriptive is by not a requirement for bearer tokens; it is, however, very convenient. These tokens can be opaque, i.e. a random string of characters, and carry absolutely no encoded information. In this case, they are meaningless to everyone except the party who issued it.

Found resources

Assigned

Read

Bookmark