Authentication is the process of verifying that a user is who they claim to be. It's the "Who are you?" question, distinct from authorization, which is "What are you allowed to do?"
Authentication vs. Authorization
Authentication (AuthN): Verifying identity
- Logging in with username and password
- Scanning your fingerprint
- Entering a code from an authenticator app
Authorization (AuthZ): Verifying permissions
- Can this user access admin pages?
- Can this user delete other users' content?
- What features can this subscription tier use?
Authentication comes first. Once we know who you are, we can determine what you can do.
Authentication Methods
Password-Based
Traditional username + password.
- Simple and familiar
- Vulnerable to breaches, phishing, weak passwords
- Should always include rate limiting and encryption
Multi-Factor Authentication (MFA)
Combines two or more factors:
- Something you know: Password, PIN
- Something you have: Phone, hardware key
- Something you are: Fingerprint, face
Social Login (OAuth)
"Sign in with Google/Facebook/etc."
- Users don't create new passwords
- Provider verifies identity
- You get limited profile information
Passwordless
Magic links, one-time codes, biometrics.
- No passwords to forget or steal
- Growing in popularity
- Email/SMS must be secure
Single Sign-On (SSO)
One login for multiple applications.
- Common in enterprises
- SAML, OAuth, OpenID Connect protocols
Authentication Best Practices
Password Security
- Enforce minimum length (12+ characters)
- Check against known breached passwords
- Don't require arbitrary complexity rules
- Hash with bcrypt, Argon2, or scrypt
Protect Against Attacks
- Rate limiting (prevent brute force)
- Account lockout after failed attempts
- CAPTCHA for suspicious activity
- Monitor for unusual login patterns
Session Management
- Use secure, HTTP-only cookies
- Implement session timeout
- Allow users to log out all sessions
- Rotate session IDs after login
Implement MFA
- Offer as option, require for sensitive actions
- Support multiple methods (app, SMS, hardware key)
- Have recovery options
Authentication Services
Instead of building from scratch:
- Auth0: Full-featured authentication platform
- Firebase Auth: Google's authentication service
- Clerk: Modern, developer-friendly
- Supabase Auth: Open-source option