The flow, step by step Once, beforehand: prints.example registers at photos.example, and gets a client_id (public) and a client_secret (kept on its server). alice clicks Import from photos.example at prints.example. prints.example redirects her browser to photos.example's /authorize, with its client_id, the scope it …

The flow, step by step Once, at startup: prints.example reads photos.example's discovery document, then its public keys. alice clicks Sign in with photos.example at prints.example. prints.example redirects her browser to photos.example's /authorize, as in OAuth2, with scope=openid profile email and a nonce. alice signs …

A bearer token replaces the session's record with a signature. curl sends the password once, to /login, inside TLS. The server answers with a token: the claims (who, which role, until when, for which services), signed with the server's private key. curl sends the token with every request, as Authorization: Bearer …

HTTP keeps nothing between requests, so a server that wants to know who is asking must be told on every request. Basic authentication, defined in RFC 7617, does it the simplest way: every request carries the username and password in a header. The tool shows each message whole, so the password can be read crossing the …

A session moves the password off the wire. The browser sends the password once, in a login form. The server creates a record, "this random id belongs to alice", and hands the id back in a cookie. The browser returns the cookie on every request, and the server looks the id up to learn who is asking. It follows Basic …

TLS protects a password on its way to a server, and that raises one question: how does a browser know it is talking to shop.example, and not to someone standing in its place? Only the server has to answer it, because the browser is the one about to hand over a secret. Six parties play out the answer: a root CA, an …

TLS is what turns the password of Basic HTTP Authentication from readable text into ciphertext. Before any HTTP is sent, the client and the server agree on a secret that nobody on the path can compute. The server proves that it holds the private key of a certificate issued for the name the client typed. Every record of …