API Authentication
Inspired by System Design Interview: Design Ticketmaster w/ a Ex-Meta Staff Engineer
Maybe not straight user ID in api.
Jwt json web token contains signed json data about the user, like what role they have. Every request contains a signature that the server can verify.
A session id in a cookie over https is safe.
Managing sessions
Sources
- System Design Interview: Design Ticketmaster w/ a Ex-Meta Staff Engineer inspired this note