Explain the principle of authentication on the site?

Question

PHP

what is in trend now for simple user authentication on the site? if we consider something simpler than OAuth2 ?
as I understand it, passing a login and a pass and receiving cookies in response - the approach has already become obsolete,
what is it rational to use now?
send each request header bearer md5(username+pass) ?

Answer 1

Yes, there is not any movement in this direction, everything is in the old, logically correct way - it all depends on the tasks set!
anymore, but it is for authorization through a third-party / your site without providing an additional API About bearer- this is for RESTful API sites. When one backend is written for web and mobile applications. Then the web, like mobile, signs any requests with "bearer {token}". Well, yes, do not confuse "{token}" and md5(user+pass). First, you authorize the user by login + pass, then give him a unique token (essentially the same session_id, but do not store the user's status). And how you already generate it on the server is the third thing. But yes, you shouldn't do md5(login + pass) =)

Answer 2

What's wrong with cookies?

Answer 3

I use cookies on a large project, the flight is normal.
Oh, and don't forget about sessions.

Answer 4

sha256(user+pass+RANDOM)
where we get RANDOM in advance from the server
And on the server we compare the received sha256(user+pass+RANDOM) with sha256(user+pass+RANDOM) from the database
and kill RANDOM
Each time the request will change

Answer 5

One simple basic authorization is enough - the login and password requested by the browser
This is good because it is simple and reliable If you
want more reliable - use https