Token authentication and authorization implementation.

The Lotpath team ( http://github.com/lotpath ) has been using Nancy for quite a while to develop server APIs for use by heterogeneous clients (iOS apps, Android apps, Angular SPA apps, etc.).

In the process, we have benefited from developing a distinct form of authentication. Our requirements were:

1) no cookies (since not all of our client apps are web browsers)
2) no need to retrieve users from a database or backend store again once they had been authenticated/authorized
3) ability for the client app to store a token with the current user's credentials for resubmission on subsequent requests (after first authenticating)
4) a hashing algorithm to ensure that a rogue client could not simply generate credentials and successfully submit them for authorization
5) server side keys for token generation with a configurable key expiration interval
6) file system storage to allow keys to survive an app restart or an app pool recycle. (Note: we did make an "in memory" option available, but this is primarily for testing. However, it could be used in a situation where the application developer would not mind expiring all users when they have to reinstall their app or in the likely event their app pool recycles...).

We trust that this contribution will prove useful to others who have come to know and love Nancy as we have.

Cheers,

Jeff Doolittle, CTO
Lotpath, Inc.
http://lotpath.com