Authentication

Knowing who the user is and what they may do: sessions and cookies, JWT, OAuth and OpenID Connect, passwords, and the most common flaws.

The outline, topic by topic

Each topic is weighted the way the exam weighs it.

Authentication: what is it?
Show the answer
Verifying who the user is.
It is the first step; it says nothing about their rights.
You want to offer « Sign in with an external account » and know the user's identity. What do you set up?
- OpenID Connect
- OAuth 2.0 alone
- A webhook
- A cookie without a session
Show the answer
OpenID Connect
The OpenID Connect ID token proves who the user is.
Authorization: what is it?
Show the answer
Deciding what the authenticated user is allowed to do.
It is checked on the server, for every resource.
What is the main drawback of a JWT?
- Hard to revoke before expiry without server-side state
- It is unreadable
- It requires a database
- It only works over HTTP
Show the answer
Hard to revoke before expiry without server-side state
The server accepts it as long as the signature is valid and the date not passed.