การยืนยันตัวตนและการอนุญาต

Two distinct concerns:

• Authentication (AuthN): who are you?
• Authorization (AuthZ): what are you allowed to do?

You must verify identity before checking permissions.

Never store plain passwords. Use a slow, salted hash like bcrypt via the buddy library.

A JSON Web Token is a signed, self-contained token holding claims (user id, roles, expiry). The server can verify it without a database lookup.

On successful login, sign a token containing the user's claims with a secret key.

On each request, read the token from the Authorization header and verify the signature. An invalid or expired token throws.

Wrap handlers so the verified identity is attached to the request, or a 401 is returned.

Once identity is known, check roles before allowing an action.

Use the right status:

• 401 Unauthorized: not authenticated (no/invalid token)
• 403 Forbidden: authenticated but lacks permission

Combine middleware with Compojure to guard specific endpoints while leaving public ones open.

Set short expiry on access tokens to limit damage if leaked, and issue long-lived refresh tokens to get new ones without re-login.

Key rules:

• Always serve auth over HTTPS
• Store secrets in environment variables, not code
• Hash passwords with bcrypt/argon2
• Keep access tokens short-lived

Test your security knowledge.

You learned to secure a Clojure backend.

• Hash passwords with bcrypt
• Issue and verify JWTs for stateless auth
• Use middleware for AuthN and role checks for AuthZ
• Return 401 vs 403 correctly