I have read about authentications and become confusing about types classification.
Let's start from Cookie-based authentication, If I understand it right, the key point is that all data, needed for user authentication, is stored in cookies. And this is my first confusion: in cookies we may store
- session id and so it becomes a Session-based authentication?
- claims, and so should it be called as a Claims-based authentication?
- I have found that some people even store JWT token in cookies, but this seems like a custom implementation of own auth flow...
Now let's switch to Claims-based authentication. The main element is the claim and the collection of claims could use as container
- cookies (as discussed above)
- token (JWT as the example).
From the other side, when we are talking about the token, it may contain any kind of information... Session Id for example...
So what have I missed? Why don't people define something like
Token-Claims-based authentications when talking about authentication types?