Oauth2 Authentication

And JWTs (Json Web Tokens).

4 flashcards · Computer Science · by lakesare

1. What does JWT consist of? xxxxx.yyyyy.zzzzz

   header.payload.signature

2. How is JWT token usually sent to backend?

   In header: Authorization: Bearer my-jwt-token

3. Describe JWT username/password authentication workflow.

   1. on sign in generate a token and sign it with JWT_SECRET if bcrypt.compare(request.password, dbUser.password) { const token = jwt.sign(dbUser, JWT_SECRET) } 2. now frontend should send with every request Authorization: Bearer my-jwt-token 3. claiming that they are some user. We can verify that by: jwt.verify(token, JWT_SECRET)

4. Describe an Oauth2 authentication workflow.

   user goes to github.com/login/oauth/authorize?client_id=OUR_CLIENT_ID (by clicking on some link in our site) if user agrees to sign in, github redirects them to localhost:3000/github/callback with some code string in URL query localhost sends code, OUR_CLIENT_ID and OUR_CLIENT_SECRET to github.com/login/oauth/access_token That gets us an access token! Having an access token we can request eg /github/profile and thus understand which user signed in by connecting github's user_id => our db's user…