1.3.2. Authentication Methods

• Authentication: Verifying the identity of a user (e.g., username/password). • Authorization: Granting access to resources based on the user's role or permissions.

Authentication is like checking someone's ID at the door of a club. You verify that they are who they say they are. Authorization, on the other hand, is deciding whether that person can enter the VIP area or just the general area based on their status. In web development, authentication ensures that users are indeed who they claim to be, usually through usernames and passwords, while authorization determines what resources or areas of the application that authenticated user can access.

Imagine a library. When you walk in, the librarian checks your library card (authentication) to ensure you have one. After they verify your identity, they can allow you to access certain parts of the library, like the adults-only section (authorization), based on your membership type.

• OAuth 2.0: A protocol for authorization, enabling third-party apps to access user data without sharing login credentials.

OAuth 2.0 is a protocol that allows applications to access user data from another service without revealing the user's login information. For example, if you want to connect your Instagram account to a photo-editing app, instead of providing your Instagram password, OAuth lets you log in through Instagram. The app gets permission to access your Instagram data without ever handling your password, thus keeping your credentials secure.

Think of OAuth 2.0 like having a valet service. You give the valet your car key (authorization) but not the actual car or the details about the car (credentials). The valet can park your car without needing full access to it.

• JWT (JSON Web Tokens): A compact and secure method for transmitting information between parties. JWTs are often used in modern REST APIs to maintain a session state.

JWTs or JSON Web Tokens are a way to securely transmit information. When a user logs into an application, a JWT is created and sent to the user's browser. This token includes user information and is signed to prevent tampering. Each time the user makes a request, they send the JWT along with it, allowing the server to verify their identity without requiring re-authentication every time.

Imagine a concert ticket. When you buy a ticket, it has your seat number and the event details printed on it. When you arrive at the concert, the staff checks your ticket to confirm it's valid (this is like the JWT verifying the user's identity). You don't have to show your ID again as long as you have the ticket.

• Multi-Factor Authentication (MFA): Adding an extra layer of security to user accounts by requiring two or more forms of identity verification (e.g., password + SMS code).

MFA adds an additional layer of security by requiring users to provide two or more verification factors to gain access to their accounts. This could mean entering your password plus a code sent to your mobile device. This way, even if someone steals your password, they cannot access your account without also having the second authentication factor.

Consider entering your house. You may have a key (first factor) to unlock the door. However, if you also have a security system that requires you to input a code (second factor) to disarm it, even someone with a copy of your key can't get in without knowing that code.

• Encryption • TLS (Transport Layer Security): Ensures that communication between the client and server is encrypted and secure. • Hashing: Storing passwords securely by using one-way encryption algorithms like bcrypt or Argon2.

Encryption is the process of converting data into a code to prevent unauthorized access. TLS, or Transport Layer Security, is a standard that secures data as it travels over the internet, ensuring that sensitive information, like passwords, remains private. Hashing, on the other hand, takes passwords and transforms them into a fixed-size string of characters that is unreadable. When a user logs in, the entered password is hashed and compared to the stored hash, making it impossible to recover the original password from the stored hash.

Think of encryption like sending a message in a secret language. Only the sender and the receiver know how to decode it. TLS acts like a sealed letter, ensuring that no one can read your message while being delivered. Hashing is like writing your password in a code that can’t be deciphered back to the original—only the secret key holder knows what it means.

--