Authenticating requests

The application can validate credentials, but that isn’t much use because there is currently no association between credentials sent to the /signin URL and any subsequent HTTP requests made by the browser.

This is the purpose of the temporary token that can be presented to the application to prove that the user has been through the credential validation process. Cookies are the most common way to solve this problem, either by creating a separate cookie or by associating authentication data with an existing session cookie, which is the approach I am going to take in this chapter because it is the simplest approach and takes advantage of session features, such as automatic inactivity expiration. Listing 15.10 uses a session to record successful authentication, and it defines middleware that detects the new session data and adds a user property to the request object:

Listing 15.10: Completing authentication in the index.ts file in the src/server...