- authentication: verifying identity (
401 Unauthorized) - authorization: verifying permissions (
403 Forbidden)
Username/password scheme
- stateful/session-based/cookie-based (i.e. session using a cookie)
- stateless/token-based (i.e. token using
JWT/OAuth/ other)