Technical reference

Authentication Cheatsheet

Sessions, tokens, authorization, and account safety

Must Know

Check authorization on every protected server operation.

authentication: who are you?
authorization: may you perform this action?

Store session data server-side and rotate IDs after login.

Set-Cookie: session=opaque-id; HttpOnly; Secure; SameSite=Lax; Path=/; Max-Age=3600

Use a maintained password-hashing library.

Argon2id(password, uniqueSalt, tunedCost)

// Store hash + parameters, never plaintext or reversible encryption.

Validate state, issuer, audience, nonce, and redirect URI.

code_verifier = random secret
code_challenge = BASE64URL(SHA256(code_verifier))

authorize -> callback code -> token exchange

javascript

Roles often need resource-level ownership checks.

requireRole(user, 'admin');
if (record.ownerId !== user.id && !user.roles.includes('admin')) deny();

Recovery is another authentication flow and needs equal protection.

short-lived single-use token
hash token in database
invalidate after use
notify account owner
rate limit requests

Decoding is not verification.

verify signature
allow-list algorithms
validate exp, nbf, iss, aud
keep access tokens short-lived
rotate signing keys

Protect the full account lifecycle, not only login.

MFA
login throttling
session revocation
audit log
suspicious-login alerts
CSRF protection