Web API Token Validation Understanding

Recently has been learning Web API authentication, for example, the JWT, can be understood as token is ID card, username and password is the hukou, ID card is valid (JWT has expiration time), and portability (self with all information contained), Hukou will not expire (user name and password when all useful), carry inconvenient (user name and password from the database verification), JWT also has the shortcomings of identity card, lost someone else can use, hukou changed the name, ID can also be used (again, JWT is not modified after the user name and password have been modified). For the shortcomings of the identity card, you can set a shorter expiration time, in addition token Auth made improvements, added the concept of refresh token. Token verification is not introduced this time, this thing online more, tokens can be defined by themselves, you can also use some standard tokens such as JSON Web token. The following is mainly about refresh token.

The purpose of the refresh token is to handle access token time expiration, and if you apply for access token every time, it is too troublesome to add the concept of refresh token, and if access token expires you can use refresh Token updates access token, and refresh token changes, which is important. In addition access token content also changed, resolved the hukou changed the name, the identity card name did not change the problem. The refresh token is important to change each time, meaning that the original token is not available after each refresh. Another advantage, needless to say, is that you do not need to store the user name and password on the client.

Understanding Refresh token first of all to understand the client, what is the client, or the only client ClientID how to get, call the Web API client can be the Web, mobile and other clients. Web application call Web API using JS call, this bit of egg pain, other server know the client can write their own code to generate a unique clientid, we can encrypt the delivery of things, and JS call API is not encrypted. Therefore, the client can be divided into two kinds of JS calls and other clients call.

See Ti6 DOTA2 Finals, next time get an example ....

Web API Token Validation Understanding