Auth

Session-based Authentication -

1. Server does all the heavy lifting server-side => A record is created for each logged-in user.

2. A client authenticates with its credentials and receives a session_id(cookie).

3. session_id is an identifier.

4. bad scale-ability

Token-based Authentication -

1. no session is persisted server-side (stateless). => it does not store anything on the server but creates a unique encoded token that gets checked every time a request is made.

2. a token which is attached to every subsequent request.

3. a string with all the necessary information is issued (the token)

https://security.stackexchange.com/questions/81756/session-authentication-vs-token-authentication

Benefits of token-based authentication

1. Cross-domain / CORS

A token-based approach allows you to make AJAX calls to any server, on any domain.

1. Stateless

Tokens are stateless. There is no need to keep a session store, since the token is a self-contained entity that stores all the user information in it.

1. CSRF (Cross Site Request Forgery)

Because the application does not rely on cookies for authentication, it is invulnerable cross site request attacks.

1. Performance

In terms of server-side load, a network roundtrip (e.g. finding a session on database) is likely to take more time than calculating an HMACSHA256 code to validate a token and parsing its contents, making token-based authentication faster than the traditional alternative.

https://www.pluralsight.com/guides/ruby-ruby-on-rails/token-based-authentication-with-ruby-on-rails-5-api