Authentication & Authorization Basics

Authentication & Authorization Basics

Who you are (authentication) and what you're allowed to do (authorization) are two separate questions that together form an application's access control. Session-based authentication (cookies, server-side sessions) and token-based authentication (JWTs, with their claims, signature, and expiry) are the two common ways to keep someone logged in. Password hashing and salting (bcrypt/Argon2) protect credentials at rest, and role-based access control keeps sensitive routes and actions restricted to the right users.

Starting Points

• LinkedIn Learning. Web Security: User Authentication and Access Control.
• JWT Handbook. jwt.io.
• Auth0 documentation. auth0.com/docs.

Key Points

• You implement a basic authentication flow (register, login, logout) using secure password storage (hashing with salt, via bcrypt or Argon2), and can explain why hashing is required.
• You use session-based or token-based (JWT) authentication to maintain logged-in state, and correctly attach session identifiers or tokens to subsequent requests.
• You define at least two roles (e.g. user, admin) and enforce role-based access on selected routes, so only authorised users can perform sensitive actions.
• You describe common security pitfalls (plain-text passwords, insecurely stored JWTs, missing access checks) and how your approach mitigates them.