1.3. Authentication and Security

• Authentication: Verifying the identity of a user (e.g., username/password). • Authorization: Granting access to resources based on the user's role or permissions.

Authentication and authorization are two crucial concepts in web security. Authentication is the process of verifying who a user is, typically through mechanisms like usernames and passwords. For example, when you log into a website, you input your username and password, and the system checks to ensure those credentials are valid before granting you access.

On the other hand, authorization determines what a user can do within the application after they are authenticated. For instance, a regular user may have access to view certain pages, while an administrator might have permission to add or delete users. In other words, authentication answers the question "Who are you?" while authorization answers "What can you do?"

Think of a nightclub as an analogy for understanding these concepts. The bouncer at the door checks your ID to see if you are on the guest list, verifying your identity (authentication). Once inside, different areas may be restricted. VIP sections are accessible only to certain users, depending on their status or membership level (authorization).

• OAuth 2.0: A protocol for authorization, enabling third-party apps to access user data without sharing login credentials. • JWT (JSON Web Tokens): A compact and secure method for transmitting information between parties. JWTs are often used in modern REST APIs to maintain a session state. • Multi-Factor Authentication (MFA): Adding an extra layer of security to user accounts by requiring two or more forms of identity verification (e.g., password + SMS code).

Authentication methods enhance user security in various ways. OAuth 2.0 is widely used by applications to grant access tokens, allowing third-party applications to access user's data without sharing passwords. For instance, when you use your Google account to log into a different service, OAuth allows you to authorize that service without giving away your password.

JSON Web Tokens (JWT) are another modern method, used to securely transmit information and maintain user sessions across websites. They contain encoded information that can verify a user’s identity without needing to store session information on the server.

Multi-Factor Authentication (MFA) increases security by requiring multiple forms of verification. Even if a user’s password is compromised, MFA ensures that a second verification step must be completed, helping prevent unauthorized access.

Consider your online banking. When you log in, you might enter your username and password (authentication) but then also receive a text message with a code that you must enter to access your account (MFA). If you were to use a service that allows you to log in using your Google account, that’s similar to OAuth, as you don’t have to share your bank’s password with the external service.

• TLS (Transport Layer Security): Ensures that communication between the client and server is encrypted and secure. • Hashing: Storing passwords securely by using one-way encryption algorithms like bcrypt or Argon2.

Encryption is essential for protecting sensitive information during communication. TLS (Transport Layer Security) encrypts the data exchanged between users and web servers, preventing eavesdroppers from reading the information. This is why you see 'HTTPS' in a website's address, indicating a secure connection.

Hashing, on the other hand, is used to securely store passwords. Instead of storing a user’s password directly, websites store a hashed version. Hashing is a one-way process—once a password is hashed, it cannot be reversed to reveal the original password. Algorithms like bcrypt and Argon2 are designed specifically for secure password storage, making it difficult for attackers to retrieve user passwords even if they gain access to the database.

Imagine sending secret messages in a locked box that only the recipient can open—this represents how TLS secures data exchanges. Hashing is like transforming a recipe into a code that only you can decipher; although the code itself is visible, it doesn’t reveal the original recipe.

--