Web Authentication
Authentication, authorization, sessions, cookies, JWT, and OAuth.
Terms in Web Authentication
Access Token
An access token represents permission to access protected resources.
Authentication
Authentication verifies the identity of a user or system.
Authorization
Authorization determines what an authenticated user or system is allowed to access.
Bearer Token
A bearer token grants access to whoever presents the token successfully.
CSRF Token
A CSRF token helps a server verify that a state-changing request originated from an authorized application context.
Cookie
A cookie is small data stored by a browser and sent with matching requests.
Identity Provider
An identity provider authenticates users and supplies identity information to applications.
JWT
JSON Web Token is a compact token format commonly used to represent claims.
Multi-Factor Authentication
MFA requires multiple independent authentication factors.
OAuth
OAuth is an authorization framework that allows applications to obtain limited access to resources.
OpenID Connect
OpenID Connect is an identity layer built on top of OAuth 2.0.
PKCE
Proof Key for Code Exchange adds a code verifier mechanism to protect OAuth authorization-code flows.
Password Hashing
Password hashing transforms passwords into one-way representations suitable for secure storage.
Password Salt
A password salt is unique random data combined with a password before hashing.
Permission
A permission represents a specific action that an authenticated identity may perform.
Refresh Token
A refresh token can be exchanged for a new access token without requiring the user to authenticate again.
Role-Based Access Control
RBAC grants permissions according to assigned user roles.
Session
A session stores information associated with a user's interaction across requests.
Session Fixation
Session fixation is an attack where an attacker attempts to force a known session identifier onto a victim.
Single Sign-On
Single Sign-On allows a user to authenticate once and access multiple connected applications.
Token Expiration
Token expiration limits how long an authentication or authorization token remains valid.