Authentication & Authorization
Master the difference between authentication and authorization, session-based vs token-based auth, JWT structure and signing, OAuth 2.0 flows (Authorization Code, PKCE, Client Credentials), OpenID Connect, MFA, and SSO architecture.
Master the difference between authentication and authorization, session-based vs token-based auth, JWT structure and signing, OAuth 2.0 flows (Authorization Code, PKCE, Client Credentials), OpenID Connect, MFA, and SSO architecture. This hands-on tutorial focuses on practical implementation of authentication & authorization concepts.
Authentication & Authorization
Authentication (AuthN) answers: "Who are you?" — verifying identity.
Authorization (AuthZ) answers: "What are you allowed to do?" — verifying permissions.
[!IMPORTANT] These two concepts are often confused but operate independently. A valid JWT token (authenticated) doesn't mean the user can access admin endpoints (authorized). Always enforce both independently.
Session-Based vs Token-Based Auth
OAuth 2.0 — Authorization Code Flow
Quiz
Quiz
Question 1 of 2A user's JWT access token is stolen from localStorage by an XSS attack. The token has a 24-hour expiry. What is the impact?
Key Takeaways
✅ Authentication = verify identity. Authorization = verify permissions. They are independent.
✅ JWT is stateless — verify by signature only, no DB lookup. Trade-off: cannot revoke before expiry.
✅ Store tokens in httpOnly cookies — XSS attacks can't read them (unlike localStorage).
✅ OAuth 2.0: Authorization Code + PKCE for user login; Client Credentials for service-to-service.
✅ RBAC — assign permissions to roles, roles to users. Never assign permissions directly to individual users.
✅ Short access tokens (15 min) + long refresh tokens (30 days in httpOnly cookie) is the industry standard.
Authentication Methods Comparison
| Method | How It Works | Stateless? | Best For |
|---|---|---|---|
| Session Cookie | Server stores session ID → cookie | ❌ Stateful | Traditional web apps |
| JWT | Signed token carries claims | ✅ Yes | Mobile/SPA APIs |
| OAuth 2.0 | Delegated access via tokens | ✅ Yes | Third-party integrations |
| API Key | Static key in header | ✅ Yes | Server-to-server, simple APIs |
| mTLS | Mutual certificate auth | ✅ Yes | Service-to-service (zero trust) |
| SAML | XML-based SSO | ❌ Stateful | Enterprise SSO |
| Passkey / WebAuthn | FIDO2 biometric | ✅ Yes | Passwordless consumer apps |
Official Resources
- 📖 Auth0 — JWT Handbook — Free, comprehensive JWT guide
- 📖 OAuth 2.0 RFC 6749 — Official specification
- 📖 OWASP Authentication Cheat Sheet — Security best practices
- 📖 OpenID Connect — Identity layer on OAuth 2.0
What's Next?
Users are authenticated — but how does data travel securely between them and your servers?
Next: HTTPS, TLS & Web Security — TLS handshake, certificate authorities, and the OWASP Top 10 attacks.