API Security in Action

5 Modern token-based authentication

This chapter covers

• Supporting cross-domain web clients with CORS
• Storing tokens using the Web Storage API
• The standard Bearer HTTP authentication scheme for tokens
• Hardening database token storage

With the addition of session cookie support, the Natter UI has become a slicker user experience, driving adoption of your platform. Marketing has bought a new domain name, nat.tr, in a doomed bid to appeal to younger users. They are insisting that logins should work across both the old and new domains, but your CSRF protections prevent the session cookies being used on the new domain from talking to the API on the old one. As the user base grows, you also want to expand to include mobile and desktop apps. Though ...