I'm new to whole authentication/authorization part in web development. Specifically JWT. So I came across a medium post explaining the fundamentals of JWT. There was a diagram which showed how the web server and authentication server had no direct communication, AFTER a JWT token had been issued by the authentication server. So, my 3 questions are:

1. What's the difference between the authentication server and the web server?

2. Is the authentication server, the database server?

3. And, since you are going to take user data(e.g password/username) from the client(browser/user), to which server do you write the code to? authentication or web? Because NodeJS/Express allows you to write the app server code right?

CodePudding user response：

1 - An auth server is usually part of a microservice architecture, if you do not have to scale you can have a simple authentification middleware in your web server.

2 - The auth server is a server usually part of a microservice architecture which role is to authentificate requests and act as a gateway to the rest of the microservices.

3 - Depends if you want to scale or not. If you want to separate auth and the rest of the apis, there are multiple ways to scale.

Hope it helps =)

CodePudding user response：

What's the difference between the authentication server and the web server?

These are two separate servers. Two different programs, potentially running on two (or more) different machines. With different purposes and responsibilities.

Is the authentication server, the database server?

No. For all you know the auth server may not use db at all. For example it can store all the data directly in files, or even in memory. Although, in practice there will be some db behind it. Auth server is just a server with a special purpose: user authentication (as the name suggests).

And, since you are going to take user data(e.g password/username) from the client(browser/user), to which server do you write the code to? authentication or web? Because NodeJS/Express allows you to write the app server code right?

Write code? Both? Depends on whether you implement the auth server by yourself or not. I'm not sure I get that question.

The point is that user credentials should be send to the auth server and the auth server is responsible for validation, secure storage and token issuing. So that other servers (in particular the one you call "web") don't have to worry about it.