Authentication Basics

Overview

Authentication verifies identity before system access is granted. Common mechanisms include passwords, tokens, and multi-factor authentication.

Core Concepts

• Identity: who the caller is
• Credential: proof of identity
• Session or token: authenticated context
• MFA: second factor for stronger assurance

sequenceDiagram
    participant Client
    participant AuthService
    participant App
    Client->>AuthService: Submit credentials
    AuthService-->>Client: Access token
    Client->>App: Request with token
    App->>AuthService: Validate token
    AuthService-->>App: Token valid
    App-->>Client: Authorized response

Practical Example

POST /auth/login
Content-Type: application/json

{
  "username": "alice",
  "password": "********"
}

Successful login returns a short-lived token and refresh token.

Production Example

Enterprise applications often combine password login with time-based one-time codes to reduce account takeover risk.

Common Pitfalls

• Long-lived tokens without rotation
• Missing brute-force protection
• Storing plaintext passwords

Key Takeaways

• Authentication should provide strong identity assurance.
• Short token lifetimes and MFA reduce risk.
• Credential handling requires secure storage and transport.