identity-access

OAuth 2.0 and OpenID Connect enable secure delegated authentication. Implement Authorization Code flow for web apps, PKCE for mobile clients, and Client Credentials for server-to-server communication. OpenID Connect extends OAuth 2.0 with identity verification through ID tokens, covering authentication and authorization in a single protocol.

JWT tokens require short expiration times (15 minutes) for access tokens and secure refresh token rotation. Sign tokens with RS256, validate signatures on every request, store refresh tokens server-side or in secure HTTP-only cookies, and rotate refresh tokens on each use to prevent token replay attacks.

RBAC restricts endpoint access by user role. Define roles (admin, user, guest), assign permissions to each role, and enforce checks at middleware or route level before processing requests. Combine with JWT claims to embed user roles in tokens for efficient, stateless authorization.

MFA methods include Time-based One-Time Password (TOTP) via authenticator apps and WebAuthn for passwordless biometric or hardware key verification. Both significantly reduce account takeover risk. Require MFA for sensitive operations and offer users choice between methods for flexibility and adoption.

Store passwords hashed with Argon2id or bcrypt using minimum 12-character requirements. Protect against CSRF by validating same-site cookies, implementing CSRF tokens in state-changing requests, and using SameSite cookie attributes to prevent cross-origin request forgery on web applications.

Yes. OAuth 2.0 handles authentication across all application types while RBAC layers authorization on top. Use Authorization Code with PKCE for web and mobile, Client Credentials for services, and embed roles in JWT tokens or fetch from a permission service to enforce role-based access consistently.