authentication and authorization in ajax call

Question

Request object and response object are not available in ajax call. And Gmail and many other sites use Ajax and authentication and authorization.

My question is: how they authenticate?

since authentication information mostly stored in Session object` and Session object is not available in ajax call.

I am from asp.net background.

Answer 1

AJAX is just a way for your web page to make HTTP requests. HTTP requests can be authenticated in several different ways .

Most modern APIs use a bearer authentication scheme (like [OAuth2][2] ), where they acquire a token from an authorization server and add it to the request in the Authorization HTTP header, like:

Authorization: bearer <base64(token)>