I am fairly new to web development, and I am learning to build web applications. I am facing a problem figuring out how to set up authentication mechanisms for a multi-user application. Let me provide some details about the architecture:
Here I have two web servers - Front-end application (written in Angular) and a back-end REST API. The two exist separately to have a more decoupled system (back-end provides the data, front-end presents it), as well as to allow third-parties to implement their own client-side applications. I am not sure if it is relevant, but the back-end API is a PostgREST web-server sitting on top of a PostgreSQL database.
As I mention before, this is a multi-user application, so I would also like to set up authentication for clients. In the context of my architecture it means setting up authentication for
api.domain.com as well as for
www.domain.com. I think that it makes more sense to use token-based authentication to access the back-end API, as it will not be accessed by browser-based client directly. As for the authentication on
www.domain.com I think I have options to either go for token-based or session-based authentication. If am getting it right the authentication process should look something like this:
The problem is that I do not understand how to set up the translation of
www.domain.com authentication to the one between
api.domain.com. What kind of authentication mechanism is most suitable for the browser-frontend communication in this situation? How to "forward" the authentication to the back-end API? Is there another way of achieving this?