Hands-On RESTful Web Services with ASP.NET Core 3

Securing APIs with token-based authentication

Applications have traditionally persisted identity through session cookies, relying on session IDs stored on the server-side. This method brings a few significant problems and pitfalls: it is not scalable, because you need a common point where you can store sessions and, every time a user is authenticated; the server will need to create a new record in a data source. Therefore, this approach may become a significant bottleneck for your web service.

Nowadays, token authentication can be helpful to authenticate and authorize users, especially in a distributed system context. The main strength of token-based authentication lies in the fact that the consumer asks for a token to an identity service. ...