What are the security benefits over a token based API security model versus sending the username & password every time?
The process of the token based approach is:
- Send a 'login' request with username and password
- Receive a token
- Use the token instead of username/password for all subsequent requests
The benefits of a token based system (according to this http://bitoftech.net/2014/06/01/token-based-authentication-asp-net-web-api-2-owin-asp-net-identity/ ) are:
- Loosely coupled technology
- Mobile friendly
However, I'm not sure why these advantages are specific to a token based approach rather than sending the username/password each time? Is it not just as easy to add subsequent web-servers to a cluster either way? The password verification is still performed in both cases, so the client-side is just as loosely coupled?
Advantages? Is it simply that the username/password does not need to be 'checked' every time and we can do a more simple lookup based on a list of session keys? While this is a performance improvement it does add increased complexity on the client application, and further complexities if there is a timeout on the token where the client would need to check if the token is still valid?
Disadvantages? Are the downsides with a username/password sent with every request that with more and more transmissions of this data it becomes more likely that it could be discovered? If so, is HTTPS not robust enough to counter this threat?
EDIT: I have read this potential duplicate: Why use an authentication token instead of the username/password per request? but I am a little unsure why point #2 states that the username/password would be stored as a cookie. Why would the client machine keep the username/password as a cookie and not include it in the post content itself?