DEV Community

Cover image for From Zero to Hero (▀̿Ĺ̯▀̿ ̿) in Authentication | Part 1

From Zero to Hero (▀̿Ĺ̯▀̿ ̿) in Authentication | Part 1

Kushagra Mehta on April 22, 2021

Authentication First focus on "WHAT". Authentication Authentication is the act of proving an assertion, such as the...
Collapse
 
sarafian profile image
Alex Sarafian

Unfortunately authentication is a word often misused.

Authentication is about confirming that you are you say you are and authorization is about knowing what you can do.

Because we use different means to implement and optimize this, we usually end up using tokens or cookies. They get validated to then allow the authorization to happen. But they are not part of the authentication flow.

But I can understand why they are collapsed together because the tools give you that perception.

How it helps you understand better the flow at least on the theoretical level.

Collapse
 
kushagra_mehta profile image
Kushagra Mehta

Yes, you are right Authentication and Authorization can sometimes be confusing. That's why I'm writing this series to explain What, and various part of Authentication.

If we want to understand Authentication and Authorization in simple terms, Authentication is validating/identifying that is the user is correct or not and Authorization is giving users rights/privileges to use resources.

For example, You go to the cinema hall to watch a movie, while entering guard check your ticket and authenticate that you pay for the ticket or not. Ok, now while roaming around you see VIP lounge but you are not authorized to go there. But if you are a good friend of the owner and he Authorize you to go to the VIP room then that is authorization.

Collapse
 
sarafian profile image
Alex Sarafian

That's why I tried to expand.

In real life it is not always to map this for various reasons.

But let's say you have an identity card and you give to a clerk in the town hall. Only card(token) validation happens. It is actually much more complicated because you are in context of federation. But I don't want to confuse you. In any case, authentication happened once when the card was issued. I'm referring to countries where the card is electronic.

Thread Thread
 
kushagra_mehta profile image
Kushagra Mehta

Yes, you explained it very well. Only the initial step is authentication after that everything is authorization till the ID gets expires. Session-ID stored in Cookie or JWT Token is just an authorization ID provided by the server which allows us to perform various functions on server resources. But on the initial steps, I have categorized stateful, stateless and everything else.

Collapse
 
dylanwatsonsoftware profile image
Dylan Watson • Edited

I'm not convinced this is a fair assessment of the two.

  1. Session information could be stolen: Don't store sensitive things in your token.
  2. Resource consuming: What extra information are you storing in the token for stateless that is "resource consuming"?
  3. Stateless is perhaps more involved, though both should be managed by libraries anyway.
  4. True
  5. Authentication token is slightly bigger but you shouldn't really need to store much in it.
  6. You most definitely can and should restrict certain parts of your system to different roles no matter the mechanism you use (not sure if that's what you meant)
  7. Stateless definitely makes it difficult to revoke tokens
Collapse
 
ozh profile image
྅༻ Ǭɀħ ༄༆ཉ

The stateful / stateless description makes sense, but why mention JWT, OpenID and so on in the intro if you're not going to explain what that is ?

Collapse
 
kushagra_mehta profile image
Kushagra Mehta

Zero to Hero is a series of posts. If you're intrested in sub-classification you can read Part 2. In part 3 I'm going to implement JWT

Collapse
 
jaladhsinghal profile image
Jaladh Singhal

Excellently written - thanks for explaining it in simple words! 👏

Collapse
 
kushagra_mehta profile image
Kushagra Mehta

😁

Collapse
 
gjeotech profile image
Onyeacholem Ifeanyi Joshua

Nice one. I did a research on something related to this last year . good work

Collapse
 
kushagra_mehta profile image
Kushagra Mehta

Thank you 😁

Collapse
 
yellow profile image
Nam Nam

Useful post, but in the comparison section between stateful and stateless Authentication I saw that you've used the wrong icon with the reference page, easily confused for reader.

Collapse
 
kushagra_mehta profile image
Kushagra Mehta

Thanks, I'll correct it. 😅

Collapse
 
dev_emmy profile image
nshimiye_emmy

Great work thanks!

Collapse
 
kushagra_mehta profile image
Kushagra Mehta

Thanks☺

Collapse
 
mukul_singhal profile image
Mukul Singhal

Great Work 😁