Skip to content
academia.sh
tr
Log in

Course Intermediate

Authentication and Authorization

By the end of this course

Start course

01

Authentication Flows

Determining on the server who the request belongs to: setting up flows from the basic scheme to the session cookie, from the signed token to refresh exchange, from delegation and federation protocols to machine keys and the second factor, the observable consequence of getting the setup wrong, and the criteria for choosing among them.

  1. 01 Authentication and Authorization Distinction Showing that determining the principal behind a request and deciding what that principal can do are two separate questions: the observable consequence of a server that asks only the first one, the distinction between 401 and 403, and building the decision on deny by default.
  2. 02 Basic Authentication Building HTTP's own basic authentication scheme: the 401 challenge and the WWW-Authenticate header, showing that the carried value is a decodable encoding, constant-time comparison, and the consequences of the credential passing on every request.
  3. 03 Session-Based Authentication Building a server-held session record and carrying the session identifier with a cookie: verifying cookie attributes in the response header, measuring identifier renewal at login, logout taking immediate effect, and idle and absolute lifetime limits.
  4. 04 Token-Based Authentication Writing the principal into the signed value the request carries, and verification coming down to a local computation: the distinction between opaque and self-contained tokens, the bearer scheme, what the signature guarantees, and measuring that logout is not immediately effective.
  5. 05 JSON Web Tokens The signed token's standard format: the three-part compact serialization, what the registered claims mean, the steps a verifier must not skip, asking the configuration rather than the token for the algorithm, the clock skew allowance, and the signing key's length.
  6. 06 Refresh Tokens Separating the short-lived access token from the long-lived refresh token: storing the refresh token only as a hash, rotating it on every use, and measuring that presenting a used token again results in family revocation.
  7. 07 OAuth 2 Flows Building authorization delegation with four roles: the authorization code flow run end to end with an authorization server, a resource server, and a client; the rules of the PKCE verifier and the state parameter; the code's single use; and the client credentials and device flows.
  8. 08 OpenID Connect Adding an identity layer on top of the authorization delegation protocol: the ID token issued with the openid scope, its separation from the access token by audience, asymmetric signature verification through the discovery document and key set, and the nonce, issuer, audience, and duration steps.
  9. 09 Enterprise Federation Checking an identity carried by an assertion through signature, issuer, audience, and duration window; preventing reuse; mapping externally supplied attributes to a local role with an explicit table; and the limit of logout.
  10. 10 API Keys The entropy of the long-lived credential issued for machine callers, the operational value of the prefix and trailing characters, storing it as a hash, rotating it with a grace window, and limiting it with scope.
  11. 11 Multi-Factor Authentication The independence of factor classes, deriving the time-based code and the cost of the clock skew window, preventing the same code from being used a second time, and storing recovery codes as single-use.

02

Credential Security

Storing a password with a slow hashing algorithm and choosing its parameters, the separate jobs of salt and pepper, password policies that do not break usability, the attack surface of the reset flow, and protecting the session from sign-in through to termination.

  1. 01 Password Storage Storing a password irreversibly: the work and memory factors of slow hashing algorithms, choosing parameters against a time budget, the shape of the stored record, and comparing it in constant time.
  2. 02 Salt and Pepper What a per-record random salt provides against precomputed tables, the information an unsalted setup leaks, the separate jobs of salt and pepper, and what keeping the pepper outside the database changes at the moment of a leak.
  3. 03 Password Policies How complexity rules narrow user behavior, the real difference a periodic change rule adds, checking against a breached password list, and a hash-prefix query that never exposes the password.
  4. 04 Account Recovery The password reset flow's attack surface: the token being randomly generated, stored as a hash, single-use, and short-lived, returning the same response against user enumeration, and what a reset does to sessions.
  5. 05 Session Security Renewing the session identifier at login, the observable result of session fixation, listing and individually terminating concurrent sessions, enforcing idle and absolute lifetime limits together, and the role of cookie attributes.

03

Authorization Models

Comparing role-, attribute-, relationship- and policy-based access control models across the same set of scenarios, mapping token scopes onto endpoints, tenant isolation, and object-level access control.

  1. 01 Role-Based Access Control Binding permissions to duty rather than to the person, how role inheritance conceals the effective permission set, where the role-based decision is right and wrong across a common scenario set, and measuring role explosion.
  2. 02 Attribute-Based Access Control Deciding from subject, object, action, and context attributes, deny priority's role in combining rules, the attribute-based model's correct and wrong decisions on the same scenario set, and the consequence of where an attribute is read from.
  3. 03 Relationship-Based Access Control Turning the links between subjects and objects into first-class data, the access question becoming a reachability query over a graph, transitive access, and the cost difference between checking a single object and listing accessible ones.
  4. 04 Policy-Based Authorization Moving the access decision out of application code into an interpreted policy document, the split between the decision point and the enforcement point, comparing the four models' decisions on the same scenario set, and testing a policy in report mode.
  5. 05 Scopes and Permissions Keeping a token's scope narrower than its owner's authority, the decision produced by the intersection of the scope and permission layers, responses that diverge by the reason for denial, measuring the access surface, and the narrowing rule on renewal.
  6. 06 Multi-Tenant Authorization Carrying the tenant boundary into the query, measuring the leak produced when the filter is forgotten, taking the tenant identity from the authenticated context, three-layer defense, and physical placement options for tenant data.
  7. 07 Object-Level Authorization The ownership boundary that remains after the role, scope, and tenant checks, the difference between putting the check inside the query and leaving it outside, entity information leaking from the response code, and making the ownership criterion scannable.

Start typing to search.

↑↓ ↵ Esc navigate · open · close