Cookies and tokens
https://tommihovi.com/2024/05/demystifying-cookies-and-tokens/
Spectacular article on pros and cons of all options
- Random keys in DB
- Basic auth
- OAuth2.0
- JWT
- Macaroons
- Biscuits
- … https://fly.io/blog/api-tokens-a-tedious-survey/
Improved format for auth tokens
https://github.blog/engineering/platform-security/behind-githubs-new-authentication-token-formats/
If implementing JWT, best practices
https://datatracker.ietf.org/doc/html/rfc8725.html
https://www.appsecvillage.com/events/dc-2023/jwt-parkour-476657