-: So we talked a lot about authorization, authentication
OAuth2, JWT tokens, et cetera.
But our course is not
about authentication and authorization, but about REST API.
So, where does the REST API fits in this flow?
So do you remember this step of sending the access token?
So the client app is sending the access token,
which now we already know is an actual a JW thing.
So it sends the token to the resource server,
and the resource server checks the signature
and reads the payload.
So what does REST API has to do with JWT?
The JWT should be sent
to the API using the authorization bearer header
and this is where the JWT fits into the REST API.
So when accessing an API of a resource server
that needs JWT in order to make authorization decisions
then the API should include
an authorization bearer header containing the JWT.
Now actually, the JWT can also be sent in the body
or as a request parameter,
but it is not recommended.
So, as an example, if we want to send JWT
to the code using the REST API,
then our API should look like this.
So you see here is the URL in this case GET,
and the host header and the authorization bearer header.
So you see here a header named authorization
and after this server bearer, and then the JWT.
Note that this screenshot containing only a partial JWT
is not a full one.
So, this is how authentication and authorization
should be used with REST API.
And again, the API itself does not perform
the actual authentication and authorization.
It's only a transfer mechanism of the data required
for the authorization and authentication to the actual code.