- authentication: verifying identity (
401 Unauthorized
) - authorization: verifying permissions (
403 Forbidden
)
Username/password scheme
- stateful/session-based/cookie-based (i.e. session using a cookie)
- stateless/token-based (i.e. token using
JWT
/OAuth
/ other)