So now we have a basic understanding what is tokens and what's the purpose of it during authentication
and authorization flow in this video?
Let's try to understand what the advantage of token based authentication compared to traditional ways
of authenticating that use it.
The very primary advantage of using tokens is it will save you from the security risk of sharing the
credentials or the network again and again for each and every request that you're sending to the backend,
because in the token based authentication, you only pass the credentials during the initial login and
post.
All the subsequent operations will carry on based upon the token that are generated by the back.
And think of a scenario where you have booked a room inside a hotel and only during the initial conversation
with the receptionist you will prove yourself by giving your I.D. proves later on that Egyptians will
give you an access card to your room.
So access card is like a token where you don't have to go to receptionist security each and every time
to prove yourself.
But instead you have a token temporary token which is given by the hotel staff itself.
And the same token you can use whenever you want to access any hotel related facilities like gym, restaurant
leave and your room in the same manner.
Tokens also work.
Once you prove your authentication to the system by passing your credentials, it will generate a token
and give you as a response which you'll be used for all the for the subsequent request that you are
going to make to that server.
And at the same time, with the help of tokens, you can invalidate them if you see any suspicious activities
instead of invalidating the credentials of the users.
If you invalidate the credentials of the user, the user will be affected so that he again has to call
the call center reset his password, which is a cumbersome process.
Instead, you will see any suspicious activities or the network or any security breaches happening inside
your system.
You can simply invalidate these tokens, which will force the user again to login with his original
credentials at the same time.
You can also set the lifespan to these tokens.
And suppose if I generate a token and set the lifespan as 24 hours, the token will be valid for one
day after one day.
Again, the user has to validate with his original credential.
Similarly, using tokens, not only we can maintain the authentication and authorization of the user,
we can also share some extra information.
Like what?
User details, like e-mail, his mobile number, his rules authorities, which you can pass inside the
token in an encrypted are encoded format to the claim so that they can also leverage that information.
On the client side are any consuming site where they need this information.
Next token will give you the reusability, like if you how many separate servers, especially in micro
services scenarios, you can use the same token that got generated from the single authorization server
and all the subsequent other servers that are staying inside.
My micro services can use the same token to validate the user details.
The next primary advantage of token based authentication is we don't maintain cookies on the browser
side, which will save us from security attacks like CSIRO attacks.
Next, with the help of tokens, we can maintain our application as a stateless.
And it's very easy to scale in micro services in scenarios where I want to scale my application horizontally.
In all such scenarios, we don't have to worry because we are not tying up our user authentication details
to a single server by maintaining a on the server instead.
Since we are using token based authentication mechanism, even if we to load balancers that redirect
or load to multiple servers inside or Microsoft's architecture, still, the token based authentication
will work because the tokens can be available to all the servers inside your application through a common
point call authorisation.
So in the previous videos we have built an easy bank application in that application.
Without our knowledge, we are using two tokens which helped us, not providing the credentials again
and again.
One is the CSR token, which protect us from CSR attacks and the other one is educationally which is
maintained the larvacide history to position and this generally token help.
As invalidating the request again and again without credentials on that back, and let's try to explore
that in the next video about these two tokens that we generated so that it will make more clear to us.
Thank you.
And see you in the next video by.