# Web Authentication at Headspace using Auth0

DevFeed: [Web Authentication at Headspace using Auth0](<https://devfeed.tech/articles/web-authentication-at-headspace-using-auth0-24572.md>)

Original publisher: [Read original article](<https://headspace.medium.com/web-authentication-at-headspace-using-auth0-f60e0e539a2c?source=rss-3da90e297190------2>)

Author: Headspace

Published: 2021-04-26T20:43:56Z

Content type: tutorial

Language: en

Sources: [Stories by Headspace on Medium](<https://devfeed.tech/sources/stories-by-headspace-on-medium.md>)

Topics: [Authentication](<https://devfeed.tech/topics/authentication.md>), [Auth0](<https://devfeed.tech/topics/auth0.md>), [Web](<https://devfeed.tech/topics/web.md>), [Cookies](<https://devfeed.tech/topics/cookies.md>), [browser](<https://devfeed.tech/topics/browser.md>)

Tags: [auth0](<https://devfeed.tech/tags/auth0.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [browser](<https://devfeed.tech/tags/browser.md>), [cookies](<https://devfeed.tech/tags/cookies.md>), [login](<https://devfeed.tech/tags/login.md>), [password](<https://devfeed.tech/tags/password.md>), [server](<https://devfeed.tech/tags/server.md>), [web](<https://devfeed.tech/tags/web.md>), [web-authentication](<https://devfeed.tech/tags/web-authentication.md>)

## AI overview

This article explains modern web authentication using usernames, passwords, session tokens, and browser cookies. It describes Headspace's authentication requirements across web, backend, iOS, and Android applications and explains why the company chose Auth0 as its authentication provider.

## Source excerpt

Author: Jesse Bond, Senior Software Engineer, Web Introduction: How does modern authentication work? Authentication allows users to securely log into a system and verify that they are who they say they are in subsequent requests. On today's web, this usually involves creating an account using a combination of username and password. Let's start with a quick refresher on how modern web authentication works. The first step is always a user submitting their login credentials into a form. Once the form is submitted, the server will determine whether or not the username and password match that of a previously registered user. If they do match, the server will return what is known as a session token. A session token is a unique identifier that authenticates requests as coming from the same user that just logged in. It's important to note that session tokens usually are temporary and have an expiration, which is determined by the server. Now that the user has a session token, each request will need to submit the session token to ensure authentication. It might sound tedious to have to submit the session token on each request, but have no fear, the cookie is here! Cookies are small bits of information that the browser stores for a domain. Cookies are also automatically submitted when a request is sent by the browser. Does this sound like a great way to handle the session token or what? Correct! Session tokens are almost always stored in a browser cookie to make authenticating requests a breeze. Authentication requirements Headspace has a large number of Single Page Apps, backend services, websites, and iOS and Android applications. We needed a robust solution for authentication that met the following requirements: Multiple platform and language support Scalable to millions of users Reliable with high uptime Ability to separate our users into different groups with varying permissions (i.e., admins vs. standard users) Ability to restrict user access to certain applications. Fo