Security Basics: AuthN and AuthZ

One-liner: Authentication proves who you are, authorization decides what you may do; TLS protects the wire, hashing protects stored passwords, and secrets never live in code.

Say this#

SAY THIS

Authentication (AuthN) — verifying identity: password, MFA, passkey/WebAuthn, SSO.
Authorization (AuthZ) — verifying permission: RBAC, ABAC, ACLs, policy engines (OPA, Cedar).
Session (server-side) — opaque session ID in an HttpOnly cookie; state in Redis/DB; revocable.
JWT (stateless token) — signed JSON claims (header.payload.signature); verifiable without a lookup; hard to revoke before expiry.
Access token + refresh token — short-lived access (minutes), long-lived refresh (days) with rotation.
OAuth 2.0 roles — Resource Owner (user), Client (app), Authorization Server (issues tokens), Resource Server (API).
OAuth flows — Authorization Code + PKCE (web/mobile), Client Credentials (service-to-service); implicit flow is deprecated.
OIDC (OpenID Connect) — identity layer on OAuth 2.0; adds the ID token and /userinfo.
RBAC — roles → permissions; simple, coarse. ABAC — attributes/policies (owner == user && time < 5pm); fine-grained. ReBAC — relationship-based (Google Zanzibar, SpiceDB).
TLS / mTLS — encrypt in transit; mTLS authenticates both sides (service mesh).
Password hashing — bcrypt, scrypt, Argon2id with per-user salt; never SHA-256 alone, never reversible.
Secrets management — Vault, AWS Secrets Manager, KMS; rotate; inject at runtime, not in repo.
OWASP Top 10 — injection, broken auth, XSS, CSRF, SSRF, misconfig; the checklist to name.
Principle of least privilege / defense in depth / zero trust — the phrases.

How it works#

TEXT

browser -> /login (Authorization Code + PKCE) -> Auth Server (Auth0/Okta/Cognito/Keycloak)       <- code -> backend exchanges code -> access token (JWT, 15 min) + refresh token (rotating)browser -> API with Authorization: Bearer <JWT> -> gateway verifies signature (JWKS), checks exp/aud/iss       -> service checks authz: role/permission or policy -> resourcebrowser -> /login (Authorization Code + PKCE) -> Auth Server (Auth0/Okta/Cognito/Keycloak)
       <- code -> backend exchanges code -> access token (JWT, 15 min) + refresh token (rotating)
browser -> API with Authorization: Bearer <JWT> -> gateway verifies signature (JWKS), checks exp/aud/iss
       -> service checks authz: role/permission or policy -> resource

Hash passwords with Argon2id/bcrypt (cost tuned to ~100-250 ms); compare in constant time.
Issue short-lived JWT access tokens signed RS256/ES256; publish public keys via JWKS; rotate keys.
Refresh tokens stored server-side (hashed), rotated on use, revocable; reuse detection kills the family.
Authorize at the gateway for coarse checks (valid token, scope) and in the service for resource-level checks (is this your order).
Cookies: HttpOnly; Secure; SameSite=Lax/Strict; CSRF tokens for cookie-based sessions.

Trade-offs#

Choice	Pro	Con
Server sessions	Instant revocation, small cookie	Lookup per request (Redis); sticky or shared store
JWT	Stateless verify, works across services	Revocation needs blocklist or short TTL; token size; key management
RBAC	Easy to reason about and audit	Role explosion for fine-grained needs
ABAC / policy engine	Expressive, centralized policy	Harder to audit "who can access X"
Own auth	Control	You will get something wrong; use Auth0/Okta/Cognito/Keycloak
bcrypt	Battle-tested	Memory-cheap for GPUs vs Argon2id

Numbers#

Access token TTL: 5-15 min; refresh token: days to weeks with rotation.
bcrypt cost 10-12 (~100-300 ms); Argon2id: e.g. 64 MB memory, 3 iterations, tuned to similar time.
TLS 1.3 handshake: 1 RTT (0-RTT resumption possible); TLS 1.2: 2 RTT.
JWT verification: ~0.05-0.5 ms (ES256/RS256) per request; a Redis session lookup ~0.5 ms.

Say this#

How it works#

Trade-offs#

Numbers#

In the interview#