In this section, let's try to understand what is the role of tokens inside authentication and authorization
flows.
Many frameworks, including spring security framework, uses token based authentication and authorization
considering its most efficient way of validating the user details for each and every request that we
receive from the client.
So basically a token can be a plain string of format you or it can be of an industry standard tokens
like JWT, which we call it adjacent token that get generated when user authenticated very first time
into the system.
We'll discuss more about what it JWT in the coming will use for noting that token is a value that get
generated when the user first authenticated into your system and the same token will be passed by the
client system for all the further requests when the user trying to access a protected resource on the
back.
And the reason why they send the token is we don't have to share the credentials.
Again and again, all the network for each and every request.
Instead, we can rely on the tokens and there are also all the ways of maintaining sition I.D. on the
back.
And we'll see what are the advantages of token compared to maintaining Section eight is on the server
side in the next value.
But for now, look at this example where a client performed a logging operation into an application,
the authorization server application, which is staying at the back, and it will validate the user
credentials.
And if the user is valid, it generates a token and send to the client application either in the header
are in query string of that response.
Now, the client will say this token either in local storage or any stories that they have access and
for every subsequent request that they are going to make to the back end, like I want to access my
account details, which is a protected resource.
I will pass this token along with the request that I want to send either in the authorization header
or wherever it is apt for my application.
And once my backend application receives this token, it will validate whether this is the really the
same token that I generated initially.
So basically the server maintains all these tokens inside in the memory are.
We also have some scenarios where applications maintain these details, either in the database or some
optimized memory service like release memory.
So so based upon the value that it obtained from thus memory, the server will validate what is a valid
token or not.
If it is a really valid, then it will give the response that the client is expecting.
Otherwise the request will be stop saying that the token is invalid.
So now we understand what is the role of tokens inside any authentication flaw.
Let's try to understand what are the advantages with the token based authentication and authorization
compared to traditional ways of dealing authorisation and authentication in the next room.
Thank you.
And see you in the next.