🔐 Authentication & Authorization

Verifying identity and controlling access.

Authentication vs Authorization

• Authentication (AuthN) — Who are you? (identity)
• Authorization (AuthZ) — What can you do? (permissions)

Authentication methods

JWT (JSON Web Token)

Client → Login → Server returns JWT
Client → Request + JWT in header → Server validates JWT

• Stateless — no server-side session
• Contains claims (user ID, roles, expiry)
• Short-lived access token (15min) + long-lived refresh token (7 days)
• Store in httpOnly cookie (not localStorage)

Session-based

Client → Login → Server creates session, returns cookie
Client → Request + cookie → Server looks up session

• Stateful — session stored server-side (Redis)
• Easier to revoke than JWT
• Better for traditional web apps

OAuth2 / OpenID Connect

• Delegate authentication to a provider (Google, GitHub)
• Use for "Sign in with..." flows
• Authorization Code flow for server apps
• PKCE flow for SPAs and mobile

Authorization models

RBAC (Role-Based)

User → has Role → Role has Permissions
Admin → can: create, read, update, delete
Editor → can: read, update
Viewer → can: read

ABAC (Attribute-Based)

Allow if: user.department === resource.department AND user.level >= 3

More flexible, more complex.

Security checklist

• [ ] Hash passwords with bcrypt/argon2
• [ ] Rate limit login attempts
• [ ] Implement account lockout after N failures
• [ ] Use HTTPS everywhere
• [ ] Validate tokens server-side on every request
• [ ] Implement CSRF protection for cookie-based auth
• [ ] Log authentication events (login, logout, failures)
• [ ] Support MFA for sensitive operations