Authenticating users
The authentication process requires the user to present their credentials to identify themselves to the application. The standard credentials are a username and password. The password is known only to the user, which means they can prove they are the user who owns the account by submitting the correct password.
Of course, passwords can be stolen or shared, and so a common approach is to require additional proof of identity. The conventional approach is to combine a password with a physical token, which can be a dedicated hardware device or an authenticator app running on a phone. The device provides a time-limited code that proves the user has the device.
To work through the details of how users are authenticated, I am going to add support for usernames and passwords to the example application. Later in the chapter, I’ll introduce an open-source package that supports a wider range of credentials, but simple passwords are enough to explain how the...
