Group items tagged

通常只允許單一 domain

回一個寫死 domain 的 Access-Control-Allow-Origin 的 HTTP Header， 但是可以在設定檔裏面做設定， 如果 request 是來自允許的 domain 的話， 就把 Access-Control-Allow-Origin 的值設定成該 domain， 如果不在白名單裡面的話當然就擋掉。

a stateless authentication mechanism as the user state is never saved in server memory

In authentication, when the user successfully logs in using their credentials, a JSON Web Token will be returned and must be saved locally (typically in local storage, but cookies can be also used), instead of the traditional approach of creating a session in the server and returning a cookie.

ser agent should send the JWT, typically in the Authorization header using the Bearer schema.