# Auth

PostXL uses Keycloak for authentication and authorization.

### Cookie Validation

The following diagram shows how server validates a user's session by first checking the authentication provider and then acquiring user's information from the database.

<div style="text-align: center;">
  <img src="assets/cookie-validation.png" width="600" />
</div>

### Acquiring an Access Token

The following diagram shows how a browser without a valid session initiates a request to the server to start the process of acquiring an access token.

<div style="text-align: center;">
  <img src="assets/auth.png" width="600" />
</div>

```ts
// Get OAuth URL
const service = new AuthenticationService()

const url = await service.getAuthenticationUrl()
console.log(url)
```

### Page Request

The following diagram shows how a request from a browser with a valid session is made to the server including the SSR pre-rendering and client hydration.

<div style="text-align: center;">
  <img src="assets/page-request.png" width="600" />
</div>
