Authentication Done Right

Authentication is one of those topics where the gap between "working" and "correct" is wide enough to cause serious problems. An API that issues tokens and accepts them on protected routes is working. Whether it is doing so in a way that is secure, maintainable, and honest about its threat model is a different question.