auth-implementation-patterns

JWT-based authentication involves creating a login endpoint that issues signed tokens, then protecting routes with middleware that validates tokens before allowing access. Store the token client-side and include it in request headers; the server verifies the signature and expiration to grant or deny access without server-side session storage.

Session-based authentication stores user state on the server and uses cookies to maintain sessions, requiring server memory and CSRF protection. Token-based authentication (JWT, OAuth2) encodes user data in a signed token the client manages, scaling better across microservices and stateless APIs without server-side session lookup.

OAuth2 and OpenID Connect enable delegated authentication through external identity providers like Google or corporate directories. OAuth2 handles authorization and token exchange; OpenID Connect adds identity verification on top, letting users log in via social or enterprise accounts without storing passwords in your application.

RBAC assigns users to roles and roles to permissions, then checks permissions in middleware or before resource access. Store role and permission data in your database, embed role claims in tokens, and validate them at endpoints to enforce fine-grained authorization based on what users can do.

Token lifecycle security covers expiration times, refresh token rotation, revocation lists, and secure storage. Set short expiration for access tokens, use longer-lived refresh tokens to obtain new ones, implement logout by blacklisting revoked tokens, and transmit tokens over HTTPS only to prevent interception.

RBAC applies to both REST and GraphQL by validating user roles and permissions before executing requests or resolvers. In REST, middleware checks permissions per route; in GraphQL, permissions guard individual fields or resolvers, allowing granular control over which data each role can query or mutate.