Every article tagged Authentication, in one place.
Showing 11 articles
A passkey replaces a password with a key pair. The private key stays on the user's device (or syncs through their password manager), and your server stores only the public key. Signing in means proving possession of the private key, usually with a fingerprint,...
After a user signs in, every later request must prove who they are. The two common approaches are server-side sessions and self-contained tokens (JWTs). Server-side sessions Browser cookie: sid=7f3b2c1e... (random, meaningless on its own) Server store: sess:7f...
OAuth 2.0 lets an app get limited access to an API on a user's behalf without seeing their password ("let this app read my calendar"). OpenID Connect (OIDC) builds on OAuth to tell the app who the user is ("Sign in with Google"). The roles Resource owner - the...
Short-lived access tokens limit damage if one leaks, but users don't want to sign in every 15 minutes. Refresh tokens bridge the gap, and rotation keeps them safe. The idea Sign-in returns a short-lived access token (for example 15 minutes) and a refresh token...
This guide adds a /auth/token login endpoint that returns a JWT, and a dependency that protects routes. It follows the pattern FastAPI's own docs use. Install pip install pyjwt "pwdlib[argon2]" Hashing and tokens # security.py from datetime import datetime, ti...
Time-based one-time passwords (TOTP) are the six-digit codes from apps like Google Authenticator, Microsoft Authenticator or 1Password. They stop most account takeovers that start with a stolen password. How TOTP works Your server and the user's app share a se...
Sometimes you need to act on a request before any page renders: redirect signed-out users, rewrite a path, or add a header. In Next.js 16 this file is called proxy.ts ; earlier versions called it middleware.ts and the idea is the same. A basic proxy // proxy.t...
"Forgot password" is a back door into every account, so it deserves as much care as the login form. 1. Requesting a reset import { randomBytes, createHash } from 'node:crypto'; const sha256 = (s) => createHash('sha256').update(s).digest('hex'); app.post('/auth...
JWTs are easy to issue and easy to get wrong. Most JWT vulnerabilities come from how tokens are verified, not from the format itself. 1. Always verify, and pin the algorithm import jwt from 'jsonwebtoken'; // Wrong: decode() does NOT check the signature const...
Credential stuffing uses username/password pairs leaked from other sites, tried automatically against yours. Because many people reuse passwords, even a small success rate means many hijacked accounts. 1. Layered rate limits import rateLimit from 'express-rate...
With magic links, users enter their email and click a link to sign in. No password to forget or reuse. It's popular for SaaS tools, newsletters and apps where users sign in occasionally. The flow User enters their email. Server creates a random, single-use tok...
