基于令牌的身份验证：应用程序与服务器(Token-based authentication: Application vs Server)

 刚刚发现基于令牌的身份验证的基本工作流程如下： 
 
 
 
 用户通过提供用户名和密码来请求访问 
 
 
 应用程序验证凭据并将令牌返回给客户端 
 
 
 然后将令牌存储在客户端上，并随后与每个请求一起发送 
 
 
 然后， 服务器验证令牌并将私有数据作为响应返回 
 
 
 现在，我或多或少了解流程，但是，我遇到了应用程序 ， 客户端和服务器这两个术语的问题。 我理解术语服务器是指存储API的位置......这也是应用程序的一部分。 但是应用程序也可以是从Web应用程序到各种平台上的移动应用程序......换句话说就是客户端 。 
 
 因此，应用程序包括服务器和客户端都不是真的。 那么，在上述背景下，每个术语的含义是什么？ 
 
 再想一想......我猜原始令牌是在服务器端生成的，然后将其返回给客户端。 这是真的？ 

Just found out that the basic workflow for token-based authentication is as follows:
 
 
 
User requests access by providing username and password
 
 
The application validates the credentials and returns a token to the client
 
 
The token is then stored on the client and sent with every request henceforth
 
 
The server then validates the token and returns private data as a response
 
 
Now, I understand the flow more or less, however, I'm having issues with the terms application, client and server. I understand the term server to mean where the API is stored... which is also part of the application. But the application could also be anything from a web app to a mobile app on various platforms... a client in other words.
 
So isn't it true that the application includes both the server and the client. So what does it mean by each term exactly, in the above context?
 
On second thoughts... I guess the original token is being generated on the server side, and this is then being returned to the client. Is this true?

原文：https://stackoverflow.com/questions/39391391