(I try to understand different concepts regarding web development in general)

Most information I find is about Single Page Applications, but how does a dynamic site make use of (for example) OAuth2/tokens? Maybe we want the pages to be rendered server-side, but have many functions here and there that make use of Websockets or Ajax calls to a web API that is protected.

How can the client/browser know who the user is all the time (for example a username and profile picture in the navbar) and how does the user get authorized or "persist across the lines" with a token that can not be stored anywhere because of XSS and CORS attacks (as I understand is the problem), that at the same time the username/avatar (as an example of what I mean) will still be displayed even when clicking around to other server rendered pages?

Can you help me with a general explanation and/or point me in the right direction to learn more?

  • Your question is incredibly broad right now. Can you please reduce the scope of the question and try to actually make it an answerable question? Right now, it's basically "Please explain authentication and authorization to me"
    – MechMK1
    Apr 3 at 14:54
  • @MechMK1 I see that security is a big topic. The main question is how will the concept of using tokens work on a site that uses both server-side rendered pages and at the same time be able to use javascript for different functions that call a protected API that is not part of the server that rendered the pages, how is the user "persisted across the lines" for example? Or how is the token used when it can not be stored?
    – Hills
    Apr 3 at 15:04
  • @MechMK1 Is the question better formulated now?
    – Hills
    Apr 3 at 15:39
  • I don't see big difference for authentication. In both cases client send auth. token to the server. In case of SPA it is not necessary to send token from the server to the client. In case the server renders code for UI, if needed, it may send the token to the client - as a cookie, as part of the body, as a header, whatever. Formulate your question more precisely. Then may be there will be a reason to reopen this question.
    – mentallurg
    Apr 3 at 20:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.