.NET Architecture & System Design Interview Question #161

What is token-based authentication?

Security Architecture, Multi-Tenancy & Disaster Recovery Senior Advanced

Quick Interview Answer

Token-based authentication uses a security token representing an authenticated identity and associated authorization information or references. A client presents the token to an API, which validates it before serving protected resources.

Detailed Explanation

Token-based authentication uses a security token representing an authenticated identity and associated authorization information or references. A client presents the token to an API, which validates it before serving protected resources.

Tokens should have controlled lifetimes, appropriate audiences and scopes, secure transport, and safe storage. Token format alone does not make an authentication system secure.

Code Example

Client
  -> obtain access token
  -> Authorization: Bearer <token>
API
  -> validate token
  -> authorize operation