Authentication Fundamentals — Authentication & Authorization Architecture

Authentication verifies identity using factors: something you know (password), have (phone, security key) or are (biometrics). A login system must store secrets safely (Argon2id/bcrypt hashes), establish a session after login, and resist common attacks: credential stuffing (reused leaked passwords), brute force, phishing, session hijacking and account enumeration.

Modern guidance (NIST SP 800-63B) favors long passwords checked against breach lists over complexity rules and forced rotation, plus phishing-resistant MFA.

Login flow (server-side session)
1. POST /login {email, password}             → rate limited per IP + account
2. look up user; verify hash (constant time) → same error for unknown user / wrong password
3. check MFA if enabled                      → TOTP / WebAuthn challenge
4. create NEW session id (rotate)            → store server-side (Redis/DB) with expiry
5. Set-Cookie: sid=...; HttpOnly; Secure; SameSite=Lax; Path=/
6. log the event (user, IP, user agent, result) for security monitoring

Common pitfalls

Fast hashes (SHA-256/MD5) for passwords.
Different messages for 'no such user' and 'wrong password'.
Not rotating the session ID at login (session fixation).

Key points

Factors: know / have / are
Slow salted hashes; breached-password checks
Rotate sessions at login; rate-limit attempts

Further reading: OWASP Authentication Cheat Sheet

Practice questions

Why is credential stuffing so effective, and how do you defend against it?

Answer

Many users reuse passwords leaked from other sites. Defenses: MFA, breached-password checks at signup/login, rate limiting and bot detection, and monitoring for unusual login patterns.

What does NIST recommend instead of forced periodic password changes?

Answer

Longer minimum lengths, screening against known-breached passwords, and changing passwords only on evidence of compromise; forced rotation leads to weak, predictable passwords.