Auth

Session-based authentication

The classic login flow: the server remembers who you are, and gets reminded on every request by a cookie.

Four steps:

• Submit, the user submits their credentials (username and password) to the server.

• Verify, the server checks those credentials against the database.

• Set Cookie, once verified, the server creates a session and sends back a Session ID as a cookie.

• Check DB, from then on, every request the browser makes automatically includes that cookie, and the server looks the Session ID up in the database to confirm who's making the request.

• The session itself, the actual "who is this, are they logged in" data, lives on the server, in the database, not in the cookie. The cookie only holds an ID pointing at that session.

• This is why it's called session-based: the server is stateful, it has to keep track of every active session somewhere, and check that store on every single request that comes in.