What is Token-based approach?
A token‑based approach authenticates or authorizes users with short‑lived tokens, rather than long‑lived passwords or sessions. Think OAuth/OIDC access tokens, refresh tokens, and proof‑of‑possession schemes that bind tokens to devices so theft isn’t enough. Tokens enable stateless APIs and granular scopes. Done right, they reduce risk and improve UX.
Design notes: limit token lifetimes, rotate keys, pin audience and issuer, and store as little as possible on clients. Detect replay, lock down CORS, and treat browser storage like a crime scene. Step up beyond bearer tokens for high‑value actions – add device binding and new proof of user through identity verification when context gets sketchy.
