In this video, I'll show you the two tokens that we are using as a funnel inside our application,
which is making our authentication and authorization flows very smooth in nature once we login into
that system.
So firstly, I came to the login page and I'm opening the console.
You can go to the applications tab.
And right now there are no cookies and tokens associated.
Now, I'll try to login into the application with my valid credentials and as soon as I click on signing,
I will be logged into the dashboard page.
And you can see there are two tokens that are generated and this is how the sample tokens that you can
think.
And these are simple in nature.
But if you have a complex requirements where along with the authentication and authorization, you also
want to pass certain user related data, then we can go to the advanced tokens like JWT tokens.
But these are very simple in nature these days, machinery and exercise of tokens.
And again, these are stored as cookies because we are going with the default behavior that is provided
by the spring secured.
But in the coming videos we can look at that one topics of JWT and how we can generate that token and
pass that in each and every request so that we don't have to rely on the cookies.
So now I'm able to perform all the operations inside my application.
And you can see all these resources are protected resources, but my server is not asking the credentials.
The reason is the backend server store's discretionary values inside the service memory.
And since this is the default behavior and we have only one back into so we should be good with this
approach.
But if we have a multiple micro solution scenario where you have a lot of servers in those scenarios,
we will go with the separate authentication server, which will help all our application servers in
generating and validating the tokens.
And exercise of Tolkan is the token that we generated by leveraging the CSIRO repository inside spring
security.
So this token will help us from the CSR of attacks.
Let's try to do some Arenda on this.
So now I'll go to this additionally and edit this value by just removing one card at the end.
And now I'm trying to perform the operation and you can see nothing thing is happening.
And in the console I am getting an authorized user, which is a four zero one, which like we are expecting.
Similarly, let's try to play with the exercise of token.
Also, in the scenario of a sort of token, if the token is change and tamper in-between compared to
what the solar generator, you will get a forbidden error, which is a four zero three error.
Let's try to validate that as well.
I'm just logging out and logging again and this time and making sure there are no cookies associated
and just enter my credentials.
I enter now.
This time, instead of editing, I can also delete the cookie.
I'm just deleting it.
And if I click on any of the backend operation, I will get a four zero three error to tow my page so
that it's not loaded completely because the backend operation fails with the four zero three error.
So this way we used the default, a token based mechanism inside spring security using Jayesh generally,
and we also built exercise of cocain to protect ourselves from that CSIR of attacks.
But these tokens have a problem.
So these tokens are very simple in nature and they don't support sharing the user related information
to the client side.
And at the same time, they are not supporting any encryption and encoding mechanisms to play extra
layer of security to your tokens.
Let's try to explore those advanced features by discussing JWT token in the next release.
Thank you.
And by.