1. Authentication (AuthN) vs. Authorization (AuthZ)
While closely linked, authentication and authorization serve different purposes:
- Authentication (AuthN): Verifies WHO a user is. (e.g., logging in with email/password, OTP, biometrics, or OpenID Connect).
- Authorization (AuthZ): Verifies WHAT a verified user is allowed to do. (e.g., checking if a user has admin credentials to delete a record via OAuth 2.0 or RBAC database tables).
2. OAuth 2.0 and OpenID Connect (OIDC)
OAuth 2.0 is an delegation protocol designed strictly for authorization. It allows applications to query access keys (Access Tokens) without accessing user passwords.
Because OAuth 2.0 does not address user identity, OpenID Connect (OIDC) was built on top of it. OIDC adds an ID Token (formatted as a JSON Web Token - JWT) containing user profile claims, turning a delegator framework into a complete identity authentication platform.
// Decoded JWT ID Token payload structure
{
"iss": "https://auth.ajitdev.com",
"sub": "usr_9281309812",
"aud": "client_portfolio_app",
"exp": 1782636000,
"iat": 1782632400,
"name": "Ajit Kumar",
"email": "ajitk23192@gmail.com",
"roles": ["developer", "author"]
}3. JSON Web Tokens (JWT) Security Rules
JWTs are stateless assertions passing security claims between systems. To prevent tampering, tokens are signed using cryptographic algorithms (like HS256 for symmetric keys, or RS256 for asymmetric public/private keys).
JWT Hardening Rules:
- Store access tokens in memory or secure context, never in LocalStorage (vulnerable to XSS attacks).
- Store refresh tokens in HTTP-only, secure, SameSite=Strict cookies to prevent both XSS and Cross-Site Request Forgery (CSRF).
- Set short expiration times (e.g., 15 minutes) on access tokens, relying on refresh tokens to issue new leases.
Written by Ajit KumarCloud & Security Specialist
BCA cloud computing and security student, studying kernel namespaces, networking protocols, security pipelines, and competitive programming solutions.