An interactive concept flow for authentication, sessions, and authorization, from its assumptions through the main operation and boundary checks.
trace / request.md
readyAuthentication answers who or what is making a request; authorization decides which actions that identity may perform on a resource. A session binds later requests to an authenticated context. Keeping these decisions separate makes access rules easier to audit and change.
Use the stages in order to explain authentication, sessions, and authorization. Each stage makes one assumption visible: what the operation promises, what representation it uses, how state changes, which boundary can invalidate a shortcut, and what evidence confirms the result.
For a worked explanation, continue to the topic article and execution trace.
Not started
Sign in to save your learning progress.