Memi: So, our next topic
is authentication and authorization.
So, what exactly are those two and why do we need them?
When developing API,
many times our API will not always be publicly accessible,
and we wouldn't want anyone with a computer
and an Internet connection will be able to access it.
We would like that only authorized users may access it,
and other users should be asked
for some kind of identification and may be denied access.
Now, to make that happen
we need to have authentication and authorization.
Authentication is the process
where the system identifies the user.
So, we now know who is the user.
And authorization is the process of figuring out
what is the user allowed to do.
So, note the difference between the two.
One tells us who is the user
and the other one what is the user allowed to do.
Now, when talking about authentication and authorization,
it's important to understand where exactly
does the API fits in.
So, here is the authentication flow.
We have the code exposing an API and we have the user.
The user calls the API
passing in the authentication and authorization data.
The API passes the data to the code
and the code decides what to do exactly with this data.
So, in the context of our course which is about API
and not about authentication and authorization,
the relevancy of the API to this discussion
is that the API passes the data to the code.
So, the API itself does not perform
the authentication and authorization checks.
So, how do we implement authentication and authorization?
There are many mechanisms performing these checks.
In this course, we will focus on a specific
and very popular mechanism called OAuth 2.
And in the next lecture we will understand exactly
how OAuth 2 is working and how to implement it.