Topic hub
Authentication
Passwords, sessions, JWTs, OAuth 2.0/OIDC, MFA and passkeys: proving who a user is.
Lessons
- Passwords and Authentication · PHP 8: Modern PHP Development
Hash passwords with password_hash, verify them safely and rehash as algorithms improve. - JWT Access Tokens and the Current User · FastAPI: From Basics to Production
Issue and verify short-lived JWTs and resolve the current user. - JWT Resource Server with OAuth2/OIDC · Spring Boot: From Basics to Production
Validate access tokens from an identity provider. - Authentication Fundamentals · Authentication & Authorization Architecture
Passwords, sessions, factors and the threats every login system must handle. - OAuth 2.0 and OpenID Connect · Authentication & Authorization Architecture
Delegated authorization with OAuth 2.0, login with OIDC, and the Authorization Code + PKCE flow. - Sessions vs Tokens: JWTs, Cookies and Refresh Tokens · Authentication & Authorization Architecture
Choose between server-side sessions and self-contained tokens, and store them safely. - MFA and Passkeys · Authentication & Authorization Architecture
Add multi-factor authentication and move toward phishing-resistant passkeys. - Single Sign-On, Federation and Provisioning · Authentication & Authorization Architecture
Enterprise SSO with OIDC and SAML, plus SCIM user provisioning. - API Keys Done Right · API Security in Depth
Identification, hashing, prefixes, scopes and rotation. - mTLS & Sender-Constrained Tokens (DPoP) · API Security in Depth
Binding credentials to a key so stolen tokens are useless. - OAuth 2.1 & the OAuth Security BCP (RFC 9700) · API Security in Depth
What changed: PKCE everywhere, no implicit or password grants, exact redirects. - Validating Access Tokens Correctly · API Security in Depth
JWT verification, opaque tokens and introspection. - Device Registry, Sessions & Remote Logout · Mobile API Best Practices
Track devices, bind push tokens and sign out lost phones. - Mobile Authentication: OAuth, PKCE & Refresh Rotation · Mobile API Best Practices
Authorization code + PKCE via the system browser; rotating refresh tokens. - Authentication and Authorization for Real-Time · Real-Time APIs
Auth at connect, per-channel authorization and token expiry.
Decision guides
Cookbook recipes
- Add JWT authentication to an Express API · Node.js
- Implement role-based access control in FastAPI · FastAPI
- Isolate tenants in a multi-tenant FastAPI app · FastAPI
- Use refresh tokens in HttpOnly cookies with FastAPI · FastAPI
- Protect routes in the Next.js App Router · Next.js
- Create encrypted session cookies in Next.js · Next.js
- Hash passwords and implement login safely in Node.js · Node.js
- Protect a PHP API with JWT bearer tokens · PHP
- Add CSRF protection to PHP forms · PHP
- Build a secure password reset flow in PHP · PHP
- Protect routes in a React SPA · React
- Refresh expired access tokens automatically · React