And that is it for this course section.
You learned that authentication is all about protecting
certain areas, certain pages on your website, for example,
or avoiding certain actions that can be taken by the user.
And that it's a multi-step process where you need to allow
users to create accounts and then log in.
But where then most importantly, you need to store
on the server whether a given user is allowed
to access certain resources or not.
And that is what we typically implement
with help of sessions and cookies as shown on this slide.
Where we validate credentials, then store some
You Are Authenticated Data in a session
on the server, for example, in a database.
And where we then send back a cookie
with that session ID to the client
so that the client, the browser is able to store that cookie
and send it along with future requests
so that we then know which session belongs to this client.
And we can then look into the session
to find out whether that user is authenticated or not.
And we did learn that both sessions and cookies can be used
outside of the authentication scope as well.
That's a very prominent and useful scenario
where you do use sessions and cookies.
But you can use cookies for other things as well.
In the end, you just set a cookie
by sending back the appropriate header,
as you saw the set cookie header,
and you can also use sessions for other things.
Like I did it before for flashing this input information
and this error onto a session
so that when we redirect back to the signup page,
we can show this error message
and we can pre-populate those input fields, but only once.
So you can always use sessions for things like that.
And last but not least,
you learned about the difference between authentication
and authorization that you might be authenticated
and you still might not be allowed to view all the data
and all the pages on a given website.
Now we are going to see and practice authentication again.
When we later built this complete online shop.