Reading 11 Authentication - liz-kavalski-401-advanced-javascript/seattle-javascript-401n13 GitHub Wiki
Securing passwords
I'm geeing a page not found from the link
Basic Auth
A method of HTTP that require a user name and password to make a request.
What is a base64 encoding?
Has a Header
Browser needs to cache credentials for a reasonable period of time to avoid constantly prompting the user for their username and password.
HTTP dose not provide a method that instruct the client to 'log out'
There are methods to clear cache
Dose the advoid thing for URL actual works?
Intro to JWT
JSON Web Token (JWT) is an open standard (RFC 7519) that defines a compact and self-contained way for securely transmitting information between parties as a JSON object.
what a RFC 7519?
*Signed tokens can verify the integrity of the claims contained within it, while encrypted tokens hide those claims from other parties.
*Should be used for Authorization and Information Exchange.
Has a header, payload and signature example: xxxxx.yyyyy.zzzzz
The header has two parts: the token and the signing algorithm being used.
The payload which is the claims.
Claimes are statement about the an entity(user) and addional data.
There are three different type of claims:registered, public, and private claims.
Registered:set of predefined claims which are not mandatory but recommended, to provide a set of useful, interoperable claims.
Public:These can be defined at will by those using JWTs or be defined as a URI that contains a collision resistant namespace.
Private: custom claims created to share information between parties that agree on using them and are neither registered or public claims.
Signature is used to verify the message wasn't changed along the way, and, in the case of tokens signed with a private key, it can also verify that the sender of the JWT is who it says it is.
the user agent should send the JWT,- normally a Authorization header.