Authentication & Authorization: Core Concepts

Concept Map

1. Credentials

A credential is anything you present to prove you are who you claim. The most common is a username + password pair, but credentials come in many forms:

2. Hashing & Salting

You never store passwords in plaintext. A hash function converts a password into a fixed-length string that can't be reversed. A salt is random data added before hashing so identical passwords produce different hashes.

# Python: Hash a password with bcrypt
import bcrypt

password = b"my_secure_password"
salt = bcrypt.gensalt(rounds=12)
hashed = bcrypt.hashpw(password, salt)

# Verify later
if bcrypt.checkpw(b"my_secure_password", hashed):
    print("Password matches!")

3. Sessions

In session-based auth, after you log in, the server creates a session (a record of your login state) and sends back a session ID as a cookie. On every subsequent request, your browser sends that cookie, and the server looks up your session.

// Express.js session setup
const session = require('express-session');

app.use(session({
  secret: 'your-secret-key',
  resave: false,
  saveUninitialized: false,
  cookie: { secure: true, httpOnly: true, maxAge: 3600000 }
}));

// After login
app.post('/login', (req, res) => {
  // ... verify credentials ...
  req.session.userId = user.id;
  req.session.role = user.role;
  res.redirect('/dashboard');
});

4. Tokens

Token-based auth flips the model: instead of the server remembering you, it gives you a signed token (like a JWT) that you carry. Each request includes the token, and the server verifies the signature without looking anything up.

// JWT creation (Node.js)
const jwt = require('jsonwebtoken');

const token = jwt.sign(
  { userId: 123, role: 'admin' },  // payload (claims)
  process.env.JWT_SECRET,           // signing key
  { expiresIn: '1h' }              // options
);

// JWT verification
try {
  const decoded = jwt.verify(token, process.env.JWT_SECRET);
  console.log(decoded.userId); // 123
} catch (err) {
  console.log('Invalid or expired token');
}

5. Access Control

Once you know WHO someone is (authentication), you need rules for WHAT they can do (authorization). The most common models:

# Simple RBAC middleware example (Python/Flask)
from functools import wraps
from flask import session, abort

def require_role(role):
    def decorator(f):
        @wraps(f)
        def wrapper(*args, **kwargs):
            if session.get('role') != role:
                abort(403)  # Forbidden
            return f(*args, **kwargs)
        return wrapper
    return decorator

@app.route('/admin')
@require_role('admin')
def admin_panel():
    return 'Welcome, admin!'

6. Multi-Factor Authentication (MFA)

MFA requires two or more different factor types. A password + a TOTP code from your phone = MFA. Two passwords ≠ MFA (same factor type).