Skip to content

Auth: SSL is just today's popular choice of a secure channel. #20

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Auth: SSL is just today's popular choice of a secure channel. #20

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
14 changes: 10 additions & 4 deletions articles/authentication-and-authorization/index.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ generally like this:
4. The server transmits the token back to the client.
5. The client includes the provided token on subsequent requests to the server as a proof of identity,
granting the user access to protected resources.

Because the token is generated at the time of login and is random and unguessable, its presence serves
as proof enough that the request comes from the user to whom the token was assigned. A token that grants
access without any additional requirements is known as a **bearer token**.
Expand All @@ -75,9 +75,15 @@ passed along in the request. Token-based authentication is superior to such a sy
3. In addition to manual revocation, tokens can be automatically expired or require additional proofs that they
should remain valid. In essence, token-based authentication gives you the power to fully control your application's
authentication and authorization flow.

Note that because bearer tokens grant immediate access to anyone possessing the token, **it is vital that any communication
that includes a token take place over an SSL-encrypted connection.**

Note that because bearer tokens grant immediate access to anyone possessing
(or guessing) the token, **it is vital that any communication
that includes a token take place over a secure channel,**
"secure" meaning third parties should be unable to obtain any (partial)
information about the token.
Nowadays (2017) the secure channel usually is the
**SSL/TLS encryption** used in an **HTTPS** connection.


### Digging Deeper

Expand Down