Session
- The client sends a login request to the server, and the request contains the user name, password information
- The server receives the request, and after the request is parsed, the user name and password are passed to the DB to verify that the user name is stored in the DB and that the password is correct (the password passed when the password is verified is encrypted with the cipher in db).
- If the user exists and the password is correct, a session file is generated on the server based on user information, which is stored in the server's memory
- Server return to client login success information and session_id, session_id stored in the client cookie
- After each visit to the server, the request will be sent back with a cookie to the server
- The server reads the SessionID in the cookie, in contrast to the session information in memory, if it exists and does not time out, and then reads the user's other information from the DB through the user information in the session.
Token
- The client sends a login request to the server, and the request contains the user name, password information
- The server receives the request, and after the request is parsed, the user name and password are passed to the DB to verify that the user name is stored in the DB and that the password is correct (when the password is encrypted, it is compared with the password in db when the password is passed).
- If the user exists and the password is correct, a string of characters is calculated on the server based on user information (such as userid, expiration time, etc.) as token
- Server return to client login success information and token (JSON form)
- The next time the client accesses the server, this token is brought in the header information of the request.
- The service side gets token after verifying the signature in token, verifying that token is issued by the server, has not been tampered with and within the validity period, through the user information in token to read the user's other information
Session&token based Auth Login method description
