Authenticating users

Authentication is the process by which you tell your application who you are; from this moment on, the application will know you—for a certain period of time, at least.

Authentication is not the same as—although it is related to—authorization. You probably need authentication if you have resources that require authorization to access them.

The general authorization flow is as follows:

1. Someone requests access to a protected resource.
2. The framework checks that the user is not authorized and redirects them to a login page, issuing a 302 code. This is the challenge stage.
3. The user supplies their credentials.
4. The credentials are checked and, if they are valid, the user is directed to the requested resource (HTTP 302) with a cookie (usually) that identifies them as being logged in.
5. Otherwise, the framework redirects to the failed login page.
6. Access to the protected...