I am trying to get a handle on some terms and mechanisms and find out how they relate to each other or how they overlap. Authenticating a theoretical web application and mobile application is the focus. The focus is on the exact difference between token based authentication and cookie based authentication and if/how they intersect.
HTTP basic/digest and complex systems like oauth/aws auth do not interest me.
I have a few assertions which I would like to put out there and see if they are correct.
- Only using authentication tokens, without sessions, is possible in mobile applications. In a browser context, you need cookies to persist the tokens client-side.
- You exchange your credentials (usually username/pw) for a token which can be limited in scope and time. But this also means that the token and everything relating to it must be persisted and handled by the server as well.
- Tokens can be revoked server-side. Cookies do not have that option and will/should expire.
- Using only cookies means that sessionId is related to the user account and not limited in any way.
I am hoping I am not too far off the mark and am thankful for any help!