Authentication and Authorization for Web Apps

Authentication and Authorization: Who Are You and What Can You Do?

Authentication is about verifying who someone is — usually through a username and password, a social login, or a fingerprint. Authorization is about what that person is allowed to do — which pages they can access, which actions they can perform. Both are essential for any application that has users.

How Authentication Works

The traditional approach uses sessions. When you log in, the server creates a session record in a database or cache, and sends your browser a cookie containing the session ID. On subsequent requests, the browser sends the cookie, and the server looks up the session to see who you are. This approach is simple and secure, but it requires server-side storage.

A more modern approach uses JSON Web Tokens (JWT). When you log in, the server creates a signed token containing your identity and permissions. The token is sent to the client, which stores it and sends it with every request. The server can verify the token without looking up anything in a database — the token itself contains the information. This is stateless and scales well, but tokens can't be revoked easily.

OAuth 2.0 and Social Login

OAuth 2.0 is the standard that lets you log in with Google, GitHub, or other providers. Your application redirects the user to the provider, who asks for permission. If the user grants it, the provider sends back a code that your application exchanges for tokens. This is more secure than handling passwords yourself, and users appreciate not having to create yet another account.

OpenID Connect adds an identity layer on top of OAuth 2.0, providing a standardized way to get the user's profile information. Most modern authentication systems implement both.

Multi-Factor Authentication

Passwords alone are not enough. People reuse passwords, fall for phishing, and use weak passwords. Multi-factor authentication (MFA) adds a second layer of security. The most common form is a time-based one-time password (TOTP) from an authenticator app. More secure are hardware security keys and passkeys, which are resistant to phishing and can't be guessed.

Authorization: Controlling Access

Once you know who someone is, you need to decide what they can do. The simplest model is Role-Based Access Control (RBAC): users have roles like admin, editor, or viewer, and each role has specific permissions. More flexible models include Attribute-Based Access Control (ABAC), which considers attributes of the user, the resource, and the environment to make decisions.

Using Authentication Providers

Building authentication from scratch is complex and risky. Modern providers like Auth0, Clerk, and Supabase Auth handle the hard parts — password hashing, session management, social login, MFA, and security monitoring. They provide SDKs that integrate with your frontend and backend, and they handle security best practices out of the box. For most projects, using a provider is the right choice.