auth

JWT authentication uses digitally signed tokens to verify user identity. Issue a short-lived access token and a longer-lived refresh token on login; validate the access token on each request and use the refresh token to issue new access tokens when the original expires. This approach works across web, mobile, and API contexts without server-side session storage.

OAuth2 is a delegated authorization standard where users authenticate via a third-party provider and receive tokens; session-based authentication stores user state server-side after login. OAuth2 suits multi-service architectures and third-party integrations, while sessions work well for single-application authentication.

Role-based access control (RBAC) assigns permissions to user roles and checks roles before allowing endpoint access. After authentication, extract the user's role from the token or session, verify it against required permissions for that endpoint, and return 403 Forbidden if unauthorized. This pattern scales to attribute-based control (ABAC) by checking multiple user attributes.

MFA adds security by requiring a second verification factor beyond the password, such as a time-based code or hardware key. Implement MFA as optional for standard users and mandatory for privileged accounts. Most applications support MFA on login or sensitive operations to balance security and user friction.

Hash passwords using a modern algorithm like bcrypt or Argon2; never store plaintext passwords. For API keys, generate cryptographically secure random strings, hash them on storage, and transmit only over HTTPS. Rotate keys regularly and revoke compromised keys immediately to limit exposure.

PKCE (Proof Key for Code Exchange) prevents authorization code interception in public clients like mobile apps and single-page applications. The client generates a code verifier, derives a challenge, and sends both during the OAuth2 flow to ensure only the legitimate client can exchange the code for tokens.