Technical difference between session and token based auth
<p>Im writing my bachelors in which i need to figure out which authentication/authorization method fits best with the company i'm collaborating with.</p>
<p>So i've been comparing the session and token based auth methods but there are a few points that are unclear to me about how tokens work and how they are better than session authentication:</p>
<p>The only benefits that are 100% clear to me are that tokens can be used from clients that doesn't have a cookie store and that they can be used with different sub domains and completely separate domains because it's not prevented the browsers CORS policy.</p>
<ul>
<li>I read that all cookies are sent with each request to the original domain( except if a cookie is set to only be sent on a secure connection ), which would mean that a token would be present twice in a request, unless of course you authenticate users from another domain. Is this a correct assumption?</li>
<li>How is a token validated serverside? After decryption, is it checked against the username, password and and secret/private key or is it only the secret/private key that is used here?</li>
<li>If i need username/userID when authorizing them for a certain resource on a server i didn't authenticate them on, can i blindly trust those credentials if i don't have the original user data to check against?</li>
</ul>
<p>Finally, many articles claim that tokens protect against CSRF.</p>
<p><a href="https://scotch.io/tutorials/the-ins-and-outs-of-token-based-authentication" rel="nofollow noreferrer">From this article:</a></p>
<blockquote>
<p>CSRF: We will also have protection against cross-site request forgery (CSRF). Users are susceptible to CSRF attacks since they can already be authenticated with say a banking site and this could be taken advantage of when visiting other sites.&quot;</p>
</blockquote>
<p>Which makes absolutely no sense to me. It seems like he's saying that a OAuth like system prevents CSRF? I don't know a lot about how CSFR works, so it might just be me that is blank here, but as far as i understand neither sessions or tokens protect against this since neither are unique to each request.</p>
<p><strong>Edit:</strong>
I just realized the reason tokens may prevent CSFR is that it's not automatically sent by the browser if another site manages to submit a form to your server from your browser. But this means tokens can be susceptible if pulled from the cookie header on the server, which if you use JWT should not be a problem since it uses it's own &quot;Authorization&quot; header, which you must set with JS.
But this still makes the scotch.io articles claim sound like nonsense to me.</p>