You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: introduction/index.html
+3-7Lines changed: 3 additions & 7 deletions
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ <h2>Authentication Challenges for Modern Web Apps</h2>
16
16
17
17
<h3>1. Apps are distributed across many servers</h3>
18
18
19
-
<p>Many of today's applications aren't deployed the same way they were in the past. It is now very common--and often necessary--for apps to be distributed across many servers so that up-time is increased and latency issues are mitigated. With this comes the side effect that, when a user accesses an application, it is no longer guaranteed that they are always accessing the same server.</p>
19
+
<p>Many of today's applications aren't deployed the same way they were in the past. It is now very common--and often necessary--for apps to be distributed across many servers so that up-time is increased and latency issues are mitigated. With this comes the side effect that, when a user accesses an application, it is no longer guaranteed that they are always accessing the same server.</p>
20
20
21
21
<p>Since traditional authentication relies on the server to keep the user's authentication state in memory, things break down when the app is accessed from different servers. The user might be logged in on one server but not on the others that the application is distributed across.</p>
22
22
@@ -32,7 +32,7 @@ <h3>2. Apps use APIs for data</h3>
32
32
33
33
<h3>3. Apps rely on downstream services</h3>
34
34
35
-
<p>Another common pattern seen with modern web applications is that they often rely on downstream services. For example, a call to the main application server might make a request to a downstream server before the original request is resolved. The issue here is that cookies don't "flow" easily to the downstream servers and can't tell those servers about the user's authentication state. Since each server has its own scheme for cookies, there is a lot of resistance to flow, and connecting to them is difficult.</p>
35
+
<p>Another common pattern seen with modern web applications is that they often rely on downstream services. For example, a call to the main application server might make a request to a downstream server before the original request is resolved. The issue here is that cookies don't "flow" easily to the downstream servers and can't tell those servers about the user's authentication state. Since each server has its own scheme for cookies, there is a lot of resistance to flow, and connecting to them is difficult.</p>
36
36
37
37
<h2>A Modern Alternative: The JSON Web Token (JWT)</h2>
38
38
@@ -68,11 +68,7 @@ <h2>A Modern Alternative: The JSON Web Token (JWT)</h2>
68
68
69
69
<p>Using a JWT for authentication helps to solve the challenges noted above. We can fully rely on data APIs that are stateless and even make requests to downstream services. Since JWT is a specification <ahref="http://jwt.io">implemented nearly everywhere</a>, connecting to downstream services built on a stack other than our own is easy. It also doesn't matter which domain is serving our API, nor does it matter which specific server a request goes to if the app is deployed across many.</p>
70
70
71
-
<p>JWT authentication can be <ahref="https://auth0.com/blog/2015/09/28/5-steps-to-add-modern-authentication-to-legacy-apps-using-jwts/">done with cookies</a>, which can be useful in situations where applications can't fully move away from using them.</p>
72
-
73
-
<h2>JWT Authentication Is Easy with Auth0</h2>
74
-
75
-
<p>Auth0 issues <ahref="http://jwt.io">JSON Web Tokens</a> on every login for your users. This means that you can have a solid <ahref="https://auth0.com/docs/identityproviders">identity infrastructure</a>, including <ahref="https://auth0.com/docs/sso/single-sign-on">Single Sign On</a>, User Management, support for Social (Facebook, Github, Twitter, etc.), Enterprise (Active Directory, LDAP, SAML, etc.) and your own database of users with just a few lines of code. Auth0 is perfect for <ahref="https://auth0.com/docs/sequence-diagrams">Single Page Applications</a> and very easy to set up.</p></div></section><sectionclass="go-tool"><divclass="container"><p>Get started with JWT today</p><ahref="/#debugger" class="btn btn-success">Start using the tool</a></div></section><divclass="tokens-created"><divclass="container"><imgsrc="/img/pic_logo_ft.svg"><p>JWT.io is brought to you by Auth0.</p><p>A cloud service, APIs and tools that eliminate the friction of identity for your applications and APIs.</p><ahref="https://auth0.com/signup" target="_blank" class="btn btn-success">Create free account</a><divclass="token"><h5>TOKENS CREATED</h5></div><divclass="counter"></div></div></div><footer><divclass="container"><divclass="columns"><divclass="column"><ahref="https://auth0.com/" target="_blank">Supported by<imgsrc="/img/ico_logo.svg"></a></div><divclass="column pull-request"><span>Missing something?</span><ahref="https://github.com/jsonwebtoken/jsonwebtoken.github.io/tree/master/views" target="_blank">Send a Pull Request</a></div><divclass="column social-counter"><ahref="https://twitter.com/auth0" data-show-count="true" class="twitter-follow-button">Follow @auth0</a></div></div></div></footer><!--Bootstrap core JavaScript
71
+
<p>JWT authentication can be <ahref="https://auth0.com/blog/2015/09/28/5-steps-to-add-modern-authentication-to-legacy-apps-using-jwts/">done with cookies</a>, which can be useful in situations where applications can't fully move away from using them.</p></div></section><sectionclass="go-tool"><divclass="container"><p>Get started with JWT today</p><ahref="/#debugger" class="btn btn-success">Start using the tool</a></div></section><divclass="tokens-created"><divclass="container"><imgsrc="/img/pic_logo_ft.svg"><p>JWT.io is brought to you by Auth0.</p><p>A cloud service, APIs and tools that eliminate the friction of identity for your applications and APIs.</p><ahref="https://auth0.com/signup" target="_blank" class="btn btn-success">Create free account</a><divclass="token"><h5>TOKENS CREATED</h5></div><divclass="counter"></div></div></div><footer><divclass="container"><divclass="columns"><divclass="column"><ahref="https://auth0.com/" target="_blank">Supported by<imgsrc="/img/ico_logo.svg"></a></div><divclass="column pull-request"><span>Missing something?</span><ahref="https://github.com/jsonwebtoken/jsonwebtoken.github.io/tree/master/views" target="_blank">Send a Pull Request</a></div><divclass="column social-counter"><ahref="https://twitter.com/auth0" data-show-count="true" class="twitter-follow-button">Follow @auth0</a></div></div></div></footer><!--Bootstrap core JavaScript
76
72
==================================================--><!-- Placed at the end of the document so the pages load faster--><scriptsrc="//ajax.googleapis.com/ajax/libs/jquery/1.11.0/jquery.min.js"></script><scriptsrc="/js/bootstrap.min.js"></script><!-- build:js dist/js/app.js--><scriptsrc="/vendor/zepto/zepto.js"></script><scriptsrc="/vendor/jsonlint/lib/jsonlint.js"></script><scriptsrc="/vendor/json-sans-eval-min/index.js"></script><scriptsrc="/vendor/codemirror/lib/codemirror.js"></script><scriptsrc="/vendor/codemirror/mode/javascript/javascript.js"></script><scriptsrc="/vendor/codemirror/addon/lint/lint.js"></script><scriptsrc="/vendor/codemirror/addon/lint/javascript-lint.js"></script><scriptsrc="/vendor/codemirror/addon/lint/json-lint.js"></script><scriptsrc="/vendor/jsrsasign/index.js"></script><scriptsrc="/vendor/jws.js/index.js"></script><scriptsrc="/js/jwt_mode.js"></script><scriptsrc="/js/jwt.js"></script><scriptsrc="/js/isotope.pkgd.min.js"></script><scriptsrc="/js/flipclock.js"></script><scriptsrc="/js/accordion.js"></script><scriptsrc="/js/app.js"></script><!-- endbuild--><script>(function(i,s,o,g,r,a,m){i['GoogleAnalyticsObject']=r;i[r]=i[r]||function(){
Copy file name to clipboardExpand all lines: views/md/introduction.md
+3-7Lines changed: 3 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -16,7 +16,7 @@ Modern web applications present a few challenges for authentication that are dif
16
16
17
17
### 1. Apps are distributed across many servers
18
18
19
-
Many of today's applications aren't deployed the same way they were in the past. It is now very common--and often necessary--for apps to be distributed across many servers so that up-time is increased and latency issues are mitigated. With this comes the side effect that, when a user accesses an application, it is no longer guaranteed that they are always accessing the same server.
19
+
Many of today's applications aren't deployed the same way they were in the past. It is now very common--and often necessary--for apps to be distributed across many servers so that up-time is increased and latency issues are mitigated. With this comes the side effect that, when a user accesses an application, it is no longer guaranteed that they are always accessing the same server.
20
20
21
21
Since traditional authentication relies on the server to keep the user's authentication state in memory, things break down when the app is accessed from different servers. The user might be logged in on one server but not on the others that the application is distributed across.
22
22
@@ -32,7 +32,7 @@ Another challenge here is that it is quite common for an API to be served from o
32
32
33
33
### 3. Apps rely on downstream services
34
34
35
-
Another common pattern seen with modern web applications is that they often rely on downstream services. For example, a call to the main application server might make a request to a downstream server before the original request is resolved. The issue here is that cookies don't "flow" easily to the downstream servers and can't tell those servers about the user's authentication state. Since each server has its own scheme for cookies, there is a lot of resistance to flow, and connecting to them is difficult.
35
+
Another common pattern seen with modern web applications is that they often rely on downstream services. For example, a call to the main application server might make a request to a downstream server before the original request is resolved. The issue here is that cookies don't "flow" easily to the downstream servers and can't tell those servers about the user's authentication state. Since each server has its own scheme for cookies, there is a lot of resistance to flow, and connecting to them is difficult.
36
36
37
37
## A Modern Alternative: The JSON Web Token (JWT)
38
38
@@ -68,8 +68,4 @@ It should be reiterated that the user's state is never saved in memory on the se
68
68
69
69
Using a JWT for authentication helps to solve the challenges noted above. We can fully rely on data APIs that are stateless and even make requests to downstream services. Since JWT is a specification [implemented nearly everywhere](http://jwt.io), connecting to downstream services built on a stack other than our own is easy. It also doesn't matter which domain is serving our API, nor does it matter which specific server a request goes to if the app is deployed across many.
70
70
71
-
JWT authentication can be [done with cookies](https://auth0.com/blog/2015/09/28/5-steps-to-add-modern-authentication-to-legacy-apps-using-jwts/), which can be useful in situations where applications can't fully move away from using them.
72
-
73
-
## JWT Authentication Is Easy with Auth0
74
-
75
-
Auth0 issues [JSON Web Tokens](http://jwt.io) on every login for your users. This means that you can have a solid [identity infrastructure](https://auth0.com/docs/identityproviders), including [Single Sign On](https://auth0.com/docs/sso/single-sign-on), User Management, support for Social (Facebook, Github, Twitter, etc.), Enterprise (Active Directory, LDAP, SAML, etc.) and your own database of users with just a few lines of code. Auth0 is perfect for [Single Page Applications](https://auth0.com/docs/sequence-diagrams) and very easy to set up.
71
+
JWT authentication can be [done with cookies](https://auth0.com/blog/2015/09/28/5-steps-to-add-modern-authentication-to-legacy-apps-using-jwts/), which can be useful in situations where applications can't fully move away from using them.
0 commit comments