Step-by-step articles on Authentication, part of our Application Security collection.
Showing 10 articles
A passkey replaces a password with a key pair. The private key stays on the user's device (or syncs through their password manager), and your server stores only the public key. Signing in means proving possession of the private key, usually with a fingerprint,...
After a user signs in, every later request must prove who they are. The two common approaches are server-side sessions and self-contained tokens (JWTs). Server-side sessions Browser cookie: sid=7f3b2c1e... (random, meaningless on its own) Server store: sess:7f...
OAuth 2.0 lets an app get limited access to an API on a user's behalf without seeing their password ("let this app read my calendar"). OpenID Connect (OIDC) builds on OAuth to tell the app who the user is ("Sign in with Google"). The roles Resource owner - the...
Short-lived access tokens limit damage if one leaks, but users don't want to sign in every 15 minutes. Refresh tokens bridge the gap, and rotation keeps them safe. The idea Sign-in returns a short-lived access token (for example 15 minutes) and a refresh token...
Time-based one-time passwords (TOTP) are the six-digit codes from apps like Google Authenticator, Microsoft Authenticator or 1Password. They stop most account takeovers that start with a stolen password. How TOTP works Your server and the user's app share a se...
"Forgot password" is a back door into every account, so it deserves as much care as the login form. 1. Requesting a reset import { randomBytes, createHash } from 'node:crypto'; const sha256 = (s) => createHash('sha256').update(s).digest('hex'); app.post('/auth...
JWTs are easy to issue and easy to get wrong. Most JWT vulnerabilities come from how tokens are verified, not from the format itself. 1. Always verify, and pin the algorithm import jwt from 'jsonwebtoken'; // Wrong: decode() does NOT check the signature const...
Authentication answers "who are you?". Authorisation answers "may you do this?". As apps grow, a clear authorisation model saves you from permission checks scattered everywhere. RBAC: role-based access control const PERMISSIONS = { admin: ['post:create', 'post...
Credential stuffing uses username/password pairs leaked from other sites, tried automatically against yours. Because many people reuse passwords, even a small success rate means many hijacked accounts. 1. Layered rate limits import rateLimit from 'express-rate...
With magic links, users enter their email and click a link to sign in. No password to forget or reuse. It's popular for SaaS tools, newsletters and apps where users sign in occasionally. The flow User enters their email. Server creates a random, single-use tok...
