Module 10 Summary
What this module established
An API key identifies a caller coarsely and proves nothing about identity, origin or permission. Authenticate the caller, then authorise the action separately - 401 and 403 tell the client different things.
Carry forward
- Credentials belong in headers. A query-string key is recorded by at least six systems you do not control.
- CORS controls what a browser lets a page read cross-origin. Every non-browser client ignores it, so it is not an access control.
- Rate limiting needs shared state, because in-process counters multiply by the worker count. Always send
Retry-Afterwith a 429.
Before moving on
Move on when authentication and authorisation are separate, no credential travels in a query string, and the limiter holds under multiple workers.