Authentication & Authorization — ระบบยืนยันตัวตนและจัดการสิทธิ์อย่างปลอดภัย 🔐Authentication & Authorization — Verifying Identity and Managing Permissions Securely 🔐

// ═══════════════════════════════
// Node.js — bcrypt
// ═══════════════════════════════
import bcrypt from 'bcrypt';

// Registration — Hash password
const SALT_ROUNDS = 12;  // Cost factor (10-12 for production)

async function registerUser(email: string, password: string) {
  // Validate password strength
  if (password.length < 8) throw new Error('Password too short');
  if (!/[A-Z]/.test(password)) throw new Error('Need uppercase');
  if (!/[0-9]/.test(password)) throw new Error('Need number');

  // Hash with bcrypt (auto-generates salt)
  const passwordHash = await bcrypt.hash(password, SALT_ROUNDS);
  // → "$2b$12$LJ3m4ys3Rz0KZ1u8Hn5YHe..."

  // Store ONLY the hash
  await db.query(
    'INSERT INTO users (email, password_hash) VALUES ($1, $2)',
    [email, passwordHash]
  );
}

// Login — Verify password
async function loginUser(email: string, password: string) {
  const user = await db.query(
    'SELECT * FROM users WHERE email = $1', [email]
  );

  if (!user) throw new Error('Invalid credentials');

  // bcrypt.compare handles salt extraction automatically
  const isValid = await bcrypt.compare(password, user.password_hash);

  if (!isValid) throw new Error('Invalid credentials');
  // ⚠️ Same error message! Don't reveal if email exists

  return user;
}

// ═══════════════════════════════
// Python — bcrypt / passlib
// ═══════════════════════════════
from passlib.hash import bcrypt

# Hash
password_hash = bcrypt.hash("MySecret123")
# → "$2b$12$LJ3m4ys3Rz..."

# Verify
is_valid = bcrypt.verify("MySecret123", password_hash)
# → True

// ═══════════════════════════════
// Python — Argon2 (recommended for new projects)
// ═══════════════════════════════
from argon2 import PasswordHasher

ph = PasswordHasher(
    time_cost=3,       # iterations
    memory_cost=65536,  # 64 MB
    parallelism=4       # threads
)

# Hash
hash = ph.hash("MySecret123")
# → "$argon2id$v=19$m=65536,t=3,p=4$..."

# Verify
try:
    ph.verify(hash, "MySecret123")  # → True
except VerifyMismatchError:
    print("Invalid password")

// ═══════════════════════════════
// Express.js — Session-based
// ═══════════════════════════════
import session from 'express-session';
import RedisStore from 'connect-redis';
import { createClient } from 'redis';

const redisClient = createClient({ url: 'redis://localhost:6379' });
await redisClient.connect();

app.use(session({
  store: new RedisStore({ client: redisClient }),
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: true,        // HTTPS only
    httpOnly: true,      // ป้องกัน XSS อ่าน cookie
    sameSite: 'strict',  // ป้องกัน CSRF
    maxAge: 24 * 60 * 60 * 1000,  // 24 hours
  }
}));

// Login
app.post('/login', async (req, res) => {
  const { email, password } = req.body;
  const user = await verifyCredentials(email, password);

  // Store user info in session
  req.session.userId = user.id;
  req.session.role = user.role;

  res.json({ message: 'Logged in' });
});

// Protected route
app.get('/api/profile', (req, res) => {
  if (!req.session.userId) {
    return res.status(401).json({ error: 'Not authenticated' });
  }
  // ... return profile
});

// Logout
app.post('/logout', (req, res) => {
  req.session.destroy();
  res.clearCookie('connect.sid');
  res.json({ message: 'Logged out' });
});

// ═══════════════════════════════
// Node.js — JWT with Access + Refresh Tokens
// ═══════════════════════════════
import jwt from 'jsonwebtoken';

const ACCESS_SECRET = process.env.JWT_ACCESS_SECRET;   // ใช้ env variable!
const REFRESH_SECRET = process.env.JWT_REFRESH_SECRET;
const ACCESS_EXPIRY = '15m';     // 15 minutes
const REFRESH_EXPIRY = '7d';     // 7 days

// ═══════════════════════════════
// Generate Tokens
// ═══════════════════════════════
function generateTokens(user) {
  const accessToken = jwt.sign(
    {
      userId: user.id,
      email: user.email,
      role: user.role,
    },
    ACCESS_SECRET,
    { expiresIn: ACCESS_EXPIRY }
  );

  const refreshToken = jwt.sign(
    { userId: user.id },
    REFRESH_SECRET,
    { expiresIn: REFRESH_EXPIRY }
  );

  return { accessToken, refreshToken };
}

// ═══════════════════════════════
// Login Endpoint
// ═══════════════════════════════
app.post('/api/auth/login', async (req, res) => {
  const { email, password } = req.body;
  const user = await verifyCredentials(email, password);

  const { accessToken, refreshToken } = generateTokens(user);

  // Store refresh token hash in DB (for revocation)
  const refreshHash = await bcrypt.hash(refreshToken, 10);
  await db.query(
    'INSERT INTO refresh_tokens (user_id, token_hash, expires_at) VALUES ($1, $2, $3)',
    [user.id, refreshHash, new Date(Date.now() + 7 * 24 * 60 * 60 * 1000)]
  );

  // Set refresh token as httpOnly cookie
  res.cookie('refreshToken', refreshToken, {
    httpOnly: true,
    secure: true,
    sameSite: 'strict',
    maxAge: 7 * 24 * 60 * 60 * 1000,
    path: '/api/auth/refresh',  // Only sent to refresh endpoint
  });

  res.json({ accessToken });
});

// ═══════════════════════════════
// Auth Middleware
// ═══════════════════════════════
function authenticate(req, res, next) {
  const authHeader = req.headers.authorization;
  if (!authHeader?.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'No token provided' });
  }

  const token = authHeader.split(' ')[1];

  try {
    const decoded = jwt.verify(token, ACCESS_SECRET);
    req.user = decoded;  // { userId, email, role }
    next();
  } catch (err) {
    if (err.name === 'TokenExpiredError') {
      return res.status(401).json({ error: 'Token expired', code: 'TOKEN_EXPIRED' });
    }
    return res.status(401).json({ error: 'Invalid token' });
  }
}

// ═══════════════════════════════
// Refresh Token Endpoint
// ═══════════════════════════════
app.post('/api/auth/refresh', async (req, res) => {
  const refreshToken = req.cookies.refreshToken;
  if (!refreshToken) return res.status(401).json({ error: 'No refresh token' });

  try {
    const decoded = jwt.verify(refreshToken, REFRESH_SECRET);

    // Check refresh token exists in DB (not revoked)
    const stored = await db.query(
      'SELECT * FROM refresh_tokens WHERE user_id = $1 AND expires_at > NOW()',
      [decoded.userId]
    );

    if (!stored.rows.length) {
      return res.status(401).json({ error: 'Refresh token revoked' });
    }

    // Verify against stored hash
    const isValid = await bcrypt.compare(refreshToken, stored.rows[0].token_hash);
    if (!isValid) return res.status(401).json({ error: 'Invalid refresh token' });

    // Get fresh user data
    const user = await db.query('SELECT * FROM users WHERE id = $1', [decoded.userId]);

    // Issue new access token
    const accessToken = jwt.sign(
      { userId: user.id, email: user.email, role: user.role },
      ACCESS_SECRET,
      { expiresIn: ACCESS_EXPIRY }
    );

    res.json({ accessToken });
  } catch (err) {
    return res.status(401).json({ error: 'Invalid refresh token' });
  }
});

// ═══════════════════════════════
// Logout — Revoke refresh token
// ═══════════════════════════════
app.post('/api/auth/logout', authenticate, async (req, res) => {
  // Delete all refresh tokens for this user
  await db.query('DELETE FROM refresh_tokens WHERE user_id = $1', [req.user.userId]);

  res.clearCookie('refreshToken', { path: '/api/auth/refresh' });
  res.json({ message: 'Logged out' });
});

// ═══════════════════════════════
// Protected Route Example
// ═══════════════════════════════
app.get('/api/profile', authenticate, async (req, res) => {
  const user = await db.query('SELECT * FROM users WHERE id = $1', [req.user.userId]);
  res.json({ user });
});

// ═══════════════════════════════
// Google OAuth 2.0 — Passport.js
// ═══════════════════════════════
import passport from 'passport';
import { Strategy as GoogleStrategy } from 'passport-google-oauth20';

passport.use(new GoogleStrategy(
  {
    clientID: process.env.GOOGLE_CLIENT_ID,
    clientSecret: process.env.GOOGLE_CLIENT_SECRET,
    callbackURL: '/api/auth/google/callback',
  },
  async (accessToken, refreshToken, profile, done) => {
    try {
      // Find or create user
      let user = await db.query(
        'SELECT * FROM users WHERE google_id = $1 OR email = $2',
        [profile.id, profile.emails[0].value]
      );

      if (!user.rows.length) {
        // Create new user
        user = await db.query(
          `INSERT INTO users (google_id, email, name, avatar_url, email_verified) 
           VALUES ($1, $2, $3, $4, true) RETURNING *`,
          [profile.id, profile.emails[0].value, profile.displayName, profile.photos[0]?.value]
        );
      } else if (!user.rows[0].google_id) {
        // Link Google account to existing user
        await db.query(
          'UPDATE users SET google_id = $1, avatar_url = COALESCE(avatar_url, $2) WHERE id = $3',
          [profile.id, profile.photos[0]?.value, user.rows[0].id]
        );
      }

      done(null, user.rows[0]);
    } catch (err) {
      done(err, null);
    }
  }
));

// Routes
app.get('/api/auth/google', 
  passport.authenticate('google', { 
    scope: ['profile', 'email'] 
  })
);

app.get('/api/auth/google/callback',
  passport.authenticate('google', { session: false }),
  (req, res) => {
    // Generate YOUR JWT
    const { accessToken, refreshToken } = generateTokens(req.user);

    // Redirect to frontend with token
    res.redirect(`${FRONTEND_URL}/auth/callback?token=${accessToken}`);
  }
);

// ═══════════════════════════════
// GitHub OAuth — Passport.js
// ═══════════════════════════════
import { Strategy as GitHubStrategy } from 'passport-github2';

passport.use(new GitHubStrategy(
  {
    clientID: process.env.GITHUB_CLIENT_ID,
    clientSecret: process.env.GITHUB_CLIENT_SECRET,
    callbackURL: '/api/auth/github/callback',
    scope: ['user:email'],
  },
  async (accessToken, refreshToken, profile, done) => {
    const email = profile.emails?.[0]?.value;
    
    let user = await findOrCreateUser({
      github_id: profile.id,
      email: email,
      name: profile.displayName || profile.username,
      avatar_url: profile.photos[0]?.value,
    });

    done(null, user);
  }
));

app.get('/api/auth/github',
  passport.authenticate('github', { scope: ['user:email'] })
);

app.get('/api/auth/github/callback',
  passport.authenticate('github', { session: false }),
  (req, res) => {
    const { accessToken } = generateTokens(req.user);
    res.redirect(`${FRONTEND_URL}/auth/callback?token=${accessToken}`);
  }
);

CREATE TABLE users (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  email VARCHAR(255) UNIQUE NOT NULL,
  name VARCHAR(100),
  avatar_url VARCHAR(500),
  password_hash VARCHAR(255),       -- NULL ถ้า login ผ่าน OAuth only
  email_verified BOOLEAN DEFAULT false,
  
  -- OAuth provider IDs
  google_id VARCHAR(255) UNIQUE,
  github_id VARCHAR(255) UNIQUE,
  facebook_id VARCHAR(255) UNIQUE,
  
  role VARCHAR(20) DEFAULT 'member',
  created_at TIMESTAMPTZ DEFAULT NOW(),
  updated_at TIMESTAMPTZ DEFAULT NOW()
);

-- Allow multiple auth methods per user
CREATE TABLE user_auth_providers (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
  provider VARCHAR(50) NOT NULL,     -- 'google', 'github', 'email'
  provider_id VARCHAR(255) NOT NULL, -- Provider's user ID
  access_token TEXT,                  -- Encrypted!
  refresh_token TEXT,                 -- Encrypted!
  token_expires_at TIMESTAMPTZ,
  created_at TIMESTAMPTZ DEFAULT NOW(),
  
  UNIQUE(provider, provider_id)
);

// ═══════════════════════════════
// TOTP Implementation — speakeasy
// ═══════════════════════════════
import speakeasy from 'speakeasy';
import qrcode from 'qrcode';

// 1. Generate secret for user
app.post('/api/auth/mfa/setup', authenticate, async (req, res) => {
  const secret = speakeasy.generateSecret({
    name: `MyApp (${req.user.email})`,
    issuer: 'MyApp',
    length: 32,
  });

  // Store secret temporarily (verify before enabling)
  await db.query(
    'UPDATE users SET mfa_secret_temp = $1 WHERE id = $2',
    [secret.base32, req.user.userId]
  );

  // Generate QR code
  const qrCodeUrl = await qrcode.toDataURL(secret.otpauth_url);

  res.json({
    qrCode: qrCodeUrl,        // Display to user
    manualKey: secret.base32,  // Manual entry fallback
  });
});

// 2. Verify and enable MFA
app.post('/api/auth/mfa/verify', authenticate, async (req, res) => {
  const { code } = req.body;
  
  const user = await db.query(
    'SELECT mfa_secret_temp FROM users WHERE id = $1',
    [req.user.userId]
  );

  const isValid = speakeasy.totp.verify({
    secret: user.rows[0].mfa_secret_temp,
    encoding: 'base32',
    token: code,
    window: 1,  // Allow 1 step before/after (±30 sec)
  });

  if (!isValid) {
    return res.status(400).json({ error: 'Invalid code' });
  }

  // Generate backup codes
  const backupCodes = Array.from({ length: 10 }, () =>
    Math.random().toString(36).substring(2, 10).toUpperCase()
  );

  // Enable MFA
  await db.query(
    `UPDATE users SET 
       mfa_enabled = true, 
       mfa_secret = mfa_secret_temp, 
       mfa_secret_temp = NULL,
       mfa_backup_codes = $1
     WHERE id = $2`,
    [JSON.stringify(backupCodes.map(c => bcrypt.hashSync(c, 10))), req.user.userId]
  );

  res.json({ 
    message: 'MFA enabled!',
    backupCodes,  // Show ONCE, user must save them
  });
});

// 3. Login with MFA
app.post('/api/auth/login', async (req, res) => {
  const { email, password, mfaCode } = req.body;
  
  // Step 1: Verify password
  const user = await verifyCredentials(email, password);
  
  // Step 2: Check if MFA enabled
  if (user.mfa_enabled) {
    if (!mfaCode) {
      return res.status(200).json({ 
        requiresMfa: true,
        message: 'Please enter your 2FA code' 
      });
    }

    // Verify TOTP code
    const isValid = speakeasy.totp.verify({
      secret: user.mfa_secret,
      encoding: 'base32',
      token: mfaCode,
      window: 1,
    });

    if (!isValid) {
      // Check backup codes
      const isBackup = await verifyBackupCode(user.id, mfaCode);
      if (!isBackup) {
        return res.status(401).json({ error: 'Invalid 2FA code' });
      }
    }
  }

  // Step 3: Issue tokens
  const tokens = generateTokens(user);
  res.json(tokens);
});

// ═══════════════════════════════
// Permission-based RBAC
// ═══════════════════════════════

const PERMISSIONS = {
  admin: [
    'users:read', 'users:create', 'users:update', 'users:delete',
    'posts:read', 'posts:create', 'posts:update', 'posts:delete',
    'settings:read', 'settings:update',
    'analytics:read',
  ],
  editor: [
    'posts:read', 'posts:create', 'posts:update', 'posts:delete',
    'analytics:read',
  ],
  member: [
    'posts:read', 'posts:create',  // Can create own posts
  ],
  guest: [
    'posts:read',                   // Read-only
  ],
};

// Middleware: Check permission
function requirePermission(...requiredPermissions) {
  return (req, res, next) => {
    const userRole = req.user.role;
    const userPermissions = PERMISSIONS[userRole] || [];

    const hasPermission = requiredPermissions.every(
      perm => userPermissions.includes(perm)
    );

    if (!hasPermission) {
      return res.status(403).json({ 
        error: 'Forbidden',
        message: `Required: ${requiredPermissions.join(', ')}`,
        yourRole: userRole,
      });
    }

    next();
  };
}

// Middleware: Check resource ownership
function requireOwnership(resourceField = 'user_id') {
  return async (req, res, next) => {
    // Admins bypass ownership check
    if (req.user.role === 'admin') return next();

    const resource = await db.query(
      `SELECT ${resourceField} FROM ${req.resourceTable} WHERE id = $1`,
      [req.params.id]
    );

    if (resource.rows[0]?.[resourceField] !== req.user.userId) {
      return res.status(403).json({ error: 'Not your resource' });
    }

    next();
  };
}

// ═══════════════════════════════
// Routes with RBAC
// ═══════════════════════════════

// Anyone can read posts
app.get('/api/posts', 
  authenticate, 
  requirePermission('posts:read'), 
  getPosts
);

// Members+ can create posts
app.post('/api/posts', 
  authenticate, 
  requirePermission('posts:create'), 
  createPost
);

// Editors+ can update any post, members only own posts
app.put('/api/posts/:id', 
  authenticate, 
  requirePermission('posts:update'), 
  requireOwnership('user_id'),  // Editors bypass, members checked
  updatePost
);

// Admin-only routes
app.get('/api/admin/users', 
  authenticate, 
  requirePermission('users:read'), 
  listUsers
);

app.delete('/api/admin/users/:id', 
  authenticate, 
  requirePermission('users:delete'), 
  deleteUser
);

-- ═══════════════════════════════
-- Flexible RBAC with DB
-- ═══════════════════════════════

CREATE TABLE roles (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  name VARCHAR(50) UNIQUE NOT NULL,  -- admin, editor, member
  description TEXT,
  is_default BOOLEAN DEFAULT false,   -- Default role for new users
  created_at TIMESTAMPTZ DEFAULT NOW()
);

CREATE TABLE permissions (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  name VARCHAR(100) UNIQUE NOT NULL,  -- posts:create, users:delete
  description TEXT,
  resource VARCHAR(50) NOT NULL,       -- posts, users, settings
  action VARCHAR(50) NOT NULL,         -- create, read, update, delete
  created_at TIMESTAMPTZ DEFAULT NOW(),
  
  UNIQUE(resource, action)
);

CREATE TABLE role_permissions (
  role_id UUID REFERENCES roles(id) ON DELETE CASCADE,
  permission_id UUID REFERENCES permissions(id) ON DELETE CASCADE,
  PRIMARY KEY (role_id, permission_id)
);

CREATE TABLE user_roles (
  user_id UUID REFERENCES users(id) ON DELETE CASCADE,
  role_id UUID REFERENCES roles(id) ON DELETE CASCADE,
  PRIMARY KEY (user_id, role_id)
);

-- ═══════════════════════════════
-- Query: Get user permissions
-- ═══════════════════════════════
SELECT DISTINCT p.name as permission
FROM users u
JOIN user_roles ur ON u.id = ur.user_id
JOIN roles r ON ur.role_id = r.id
JOIN role_permissions rp ON r.id = rp.role_id
JOIN permissions p ON rp.permission_id = p.id
WHERE u.id = $1;

// ═══════════════════════════════
// Rate Limiting — express-rate-limit
// ═══════════════════════════════
import rateLimit from 'express-rate-limit';

// General API rate limit
const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,  // 15 minutes
  max: 100,                   // 100 requests per window
  message: { error: 'Too many requests, try again later' },
  standardHeaders: true,
  legacyHeaders: false,
});
app.use('/api/', apiLimiter);

// Strict login rate limit
const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,  // 15 minutes
  max: 5,                     // 5 login attempts
  skipSuccessfulRequests: true,
  message: { error: 'Too many login attempts. Try again in 15 minutes.' },
});
app.use('/api/auth/login', loginLimiter);

// Password reset rate limit
const resetLimiter = rateLimit({
  windowMs: 60 * 60 * 1000,  // 1 hour
  max: 3,                     // 3 reset requests per hour
});
app.use('/api/auth/reset-password', resetLimiter);

// ═══════════════════════════════
// Helmet.js — Security Headers
// ═══════════════════════════════
import helmet from 'helmet';

app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      imgSrc: ["'self'", "data:", "https:"],
      connectSrc: ["'self'", "https://api.myapp.com"],
    },
  },
  hsts: {
    maxAge: 31536000,      // 1 year
    includeSubDomains: true,
    preload: true,
  },
  referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
}));

// CORS configuration
import cors from 'cors';

app.use(cors({
  origin: ['https://myapp.com', 'https://admin.myapp.com'],
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  credentials: true,
  maxAge: 86400,  // Preflight cache 24h
}));

Every app you use each day has to know who you are and what you should be allowed to reach — LINE (login + you see only your own chats), Banking App (OTP + you see only your own accounts), GitHub (OAuth + you can edit only the repos you have rights to) 🔐

🚨 "99% of data breaches = authentication/authorization failures" — a weak auth system is a front door left standing open

---

🐕 Authentication vs Authorization — What's the Difference?

Most people assume Authentication and Authorization are the same thing, but they are very different! Authentication (AuthN) proves "who you really are". Authorization (AuthZ) decides "what you are allowed to do once we know who you are".

Picture a hotel — Authentication is showing your passport at check-in (proving your identity) and receiving a key card. Authorization is that key card opening only room 401, not anybody else's, and letting you into the pool only between 6 a.m. and 8 p.m.

Why do you need both? Because knowing who you are is not enough — permissions have to be assigned as well, or everyone would reach everything with Admin rights, which is an enormous risk.

The key point: Authentication must come first → then Authorization.

---

🔑 Password Security — How to Do It Safely

Password security is the heart of any authentication system — get it wrong and every one of your users pays for it. Storing passwords as plaintext is the gravest mistake of all, because the moment the database leaks, the attacker walks away with everyone's real password, ready to use.

Even older hash algorithms such as MD5 or SHA-256 are not safe, because an attacker can use Rainbow Tables (tables of popular passwords paired with their pre-computed hash values) to crack them within seconds.

The fix is to use algorithms designed to be "deliberately slow" — bcrypt, scrypt or Argon2 — so that brute forcing takes far longer, together with a Salt (random data mixed in before hashing) so that the same password produces a different hash for every user.

Password Hashing — never store plaintext, ever!

Implementation — bcrypt

// ═══════════════════════════════
// Node.js — bcrypt
// ═══════════════════════════════
import bcrypt from 'bcrypt';

// Registration — Hash password
const SALT_ROUNDS = 12;  // Cost factor (10-12 for production)

async function registerUser(email: string, password: string) {
  // Validate password strength
  if (password.length < 8) throw new Error('Password too short');
  if (!/[A-Z]/.test(password)) throw new Error('Need uppercase');
  if (!/[0-9]/.test(password)) throw new Error('Need number');

  // Hash with bcrypt (auto-generates salt)
  const passwordHash = await bcrypt.hash(password, SALT_ROUNDS);
  // → "$2b$12$LJ3m4ys3Rz0KZ1u8Hn5YHe..."

  // Store ONLY the hash
  await db.query(
    'INSERT INTO users (email, password_hash) VALUES ($1, $2)',
    [email, passwordHash]
  );
}

// Login — Verify password
async function loginUser(email: string, password: string) {
  const user = await db.query(
    'SELECT * FROM users WHERE email = $1', [email]
  );

  if (!user) throw new Error('Invalid credentials');

  // bcrypt.compare handles salt extraction automatically
  const isValid = await bcrypt.compare(password, user.password_hash);

  if (!isValid) throw new Error('Invalid credentials');
  // ⚠️ Same error message! Don't reveal if email exists

  return user;
}

// ═══════════════════════════════
// Python — bcrypt / passlib
// ═══════════════════════════════
from passlib.hash import bcrypt

# Hash
password_hash = bcrypt.hash("MySecret123")
# → "$2b$12$LJ3m4ys3Rz..."

# Verify
is_valid = bcrypt.verify("MySecret123", password_hash)
# → True

// ═══════════════════════════════
// Python — Argon2 (recommended for new projects)
// ═══════════════════════════════
from argon2 import PasswordHasher

ph = PasswordHasher(
    time_cost=3,       # iterations
    memory_cost=65536,  # 64 MB
    parallelism=4       # threads
)

# Hash
hash = ph.hash("MySecret123")
# → "$argon2id$v=19$m=65536,t=3,p=4$..."

# Verify
try:
    ph.verify(hash, "MySecret123")  # → True
except VerifyMismatchError:
    print("Invalid password")

What SALT_ROUNDS means: it sets how many rounds of hashing are performed — more rounds, slower and safer, but heavier on CPU. For production, 10-12 rounds is the recommendation (roughly 100-300 ms per call). Never go below 10!

Why the error message must be identical: whether the email does not exist in the system or the password is wrong, you must return the same error ("Invalid credentials"), so an attacker cannot learn which email addresses are registered (a Username Enumeration Attack).

Password Hashing Algorithms Comparison

Choosing a password hashing algorithm means weighing three factors: security, speed, and memory use. Older algorithms such as MD5/SHA were designed to be fast, which makes them unfit for passwords; the newer ones were designed to be slow, precisely to make brute forcing harder.

💡 Recommendation 2026:
├── New projects → Argon2id
├── Existing projects → bcrypt (still very good)
└── Avoid → MD5, SHA-*, PBKDF2 (for passwords)

---

🎟️ Session vs Token — How Do You Keep State?

Once authentication succeeds, the system has to remember that this user is logged in, or they would have to log in again on every request. There are two main ways to keep that state: session-based (the data lives on the server) and token-based (the data lives on the client).

Session-based Authentication

Session-based authentication is the traditional approach: the user's data is kept on the server (in a database or in Redis) and a Session ID is returned to the client in a cookie. On the next request, the server uses that session ID to look the user's data up in the database.

Why cookie flags matter: the httpOnly flag stops JavaScript from reading the cookie (protection against XSS), the secure flag sends it over HTTPS only, and sameSite=strict blocks CSRF attacks. Getting these settings right is not optional.

// ═══════════════════════════════
// Express.js — Session-based
// ═══════════════════════════════
import session from 'express-session';
import RedisStore from 'connect-redis';
import { createClient } from 'redis';

const redisClient = createClient({ url: 'redis://localhost:6379' });
await redisClient.connect();

app.use(session({
  store: new RedisStore({ client: redisClient }),
  secret: process.env.SESSION_SECRET,
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: true,        // HTTPS only
    httpOnly: true,      // Stop XSS from reading the cookie
    sameSite: 'strict',  // Stop CSRF
    maxAge: 24 * 60 * 60 * 1000,  // 24 hours
  }
}));

// Login
app.post('/login', async (req, res) => {
  const { email, password } = req.body;
  const user = await verifyCredentials(email, password);

  // Store user info in session
  req.session.userId = user.id;
  req.session.role = user.role;

  res.json({ message: 'Logged in' });
});

// Protected route
app.get('/api/profile', (req, res) => {
  if (!req.session.userId) {
    return res.status(401).json({ error: 'Not authenticated' });
  }
  // ... return profile
});

// Logout
app.post('/logout', (req, res) => {
  req.session.destroy();
  res.clearCookie('connect.sid');
  res.json({ message: 'Logged out' });
});

Token-based Authentication (JWT)

Token-based authentication uses JSON Web Tokens (JWT), a stateless approach — meaning the server keeps no session data at all, because everything it needs is inside the token the client is holding.

Why you need both an access and a refresh token: the access token is short-lived (15 minutes) to limit the damage if it is stolen, while the refresh token is long-lived (7 days) but kept in an httpOnly cookie and used for one thing only — requesting a new access token.

The upside is that the server does not have to query the database on every request (the data is already in the JWT), which makes it easy to scale and a natural fit for microservices. The downside is that revoking a token before it expires is hard.

JWT Structure — What's Inside?

Reading the JWT structure: the header says which algorithm was used for signing, the payload carries the user data and the timestamps, and the signature certifies that none of it has been altered.

A word of warning! Anyone can Base64-decode the payload (try it at jwt.io), so never put secrets — a password, a credit card number, a social security number — inside a JWT. Not ever!

JWT Implementation

// ═══════════════════════════════
// Node.js — JWT with Access + Refresh Tokens
// ═══════════════════════════════
import jwt from 'jsonwebtoken';

const ACCESS_SECRET = process.env.JWT_ACCESS_SECRET;   // Use an env variable!
const REFRESH_SECRET = process.env.JWT_REFRESH_SECRET;
const ACCESS_EXPIRY = '15m';     // 15 minutes
const REFRESH_EXPIRY = '7d';     // 7 days

// ═══════════════════════════════
// Generate Tokens
// ═══════════════════════════════
function generateTokens(user) {
  const accessToken = jwt.sign(
    {
      userId: user.id,
      email: user.email,
      role: user.role,
    },
    ACCESS_SECRET,
    { expiresIn: ACCESS_EXPIRY }
  );

  const refreshToken = jwt.sign(
    { userId: user.id },
    REFRESH_SECRET,
    { expiresIn: REFRESH_EXPIRY }
  );

  return { accessToken, refreshToken };
}

// ═══════════════════════════════
// Login Endpoint
// ═══════════════════════════════
app.post('/api/auth/login', async (req, res) => {
  const { email, password } = req.body;
  const user = await verifyCredentials(email, password);

  const { accessToken, refreshToken } = generateTokens(user);

  // Store refresh token hash in DB (for revocation)
  const refreshHash = await bcrypt.hash(refreshToken, 10);
  await db.query(
    'INSERT INTO refresh_tokens (user_id, token_hash, expires_at) VALUES ($1, $2, $3)',
    [user.id, refreshHash, new Date(Date.now() + 7 * 24 * 60 * 60 * 1000)]
  );

  // Set refresh token as httpOnly cookie
  res.cookie('refreshToken', refreshToken, {
    httpOnly: true,
    secure: true,
    sameSite: 'strict',
    maxAge: 7 * 24 * 60 * 60 * 1000,
    path: '/api/auth/refresh',  // Only sent to refresh endpoint
  });

  res.json({ accessToken });
});

// ═══════════════════════════════
// Auth Middleware
// ═══════════════════════════════
function authenticate(req, res, next) {
  const authHeader = req.headers.authorization;
  if (!authHeader?.startsWith('Bearer ')) {
    return res.status(401).json({ error: 'No token provided' });
  }

  const token = authHeader.split(' ')[1];

  try {
    const decoded = jwt.verify(token, ACCESS_SECRET);
    req.user = decoded;  // { userId, email, role }
    next();
  } catch (err) {
    if (err.name === 'TokenExpiredError') {
      return res.status(401).json({ error: 'Token expired', code: 'TOKEN_EXPIRED' });
    }
    return res.status(401).json({ error: 'Invalid token' });
  }
}

// ═══════════════════════════════
// Refresh Token Endpoint
// ═══════════════════════════════
app.post('/api/auth/refresh', async (req, res) => {
  const refreshToken = req.cookies.refreshToken;
  if (!refreshToken) return res.status(401).json({ error: 'No refresh token' });

  try {
    const decoded = jwt.verify(refreshToken, REFRESH_SECRET);

    // Check refresh token exists in DB (not revoked)
    const stored = await db.query(
      'SELECT * FROM refresh_tokens WHERE user_id = $1 AND expires_at > NOW()',
      [decoded.userId]
    );

    if (!stored.rows.length) {
      return res.status(401).json({ error: 'Refresh token revoked' });
    }

    // Verify against stored hash
    const isValid = await bcrypt.compare(refreshToken, stored.rows[0].token_hash);
    if (!isValid) return res.status(401).json({ error: 'Invalid refresh token' });

    // Get fresh user data
    const user = await db.query('SELECT * FROM users WHERE id = $1', [decoded.userId]);

    // Issue new access token
    const accessToken = jwt.sign(
      { userId: user.id, email: user.email, role: user.role },
      ACCESS_SECRET,
      { expiresIn: ACCESS_EXPIRY }
    );

    res.json({ accessToken });
  } catch (err) {
    return res.status(401).json({ error: 'Invalid refresh token' });
  }
});

// ═══════════════════════════════
// Logout — Revoke refresh token
// ═══════════════════════════════
app.post('/api/auth/logout', authenticate, async (req, res) => {
  // Delete all refresh tokens for this user
  await db.query('DELETE FROM refresh_tokens WHERE user_id = $1', [req.user.userId]);

  res.clearCookie('refreshToken', { path: '/api/auth/refresh' });
  res.json({ message: 'Logged out' });
});

// ═══════════════════════════════
// Protected Route Example
// ═══════════════════════════════
app.get('/api/profile', authenticate, async (req, res) => {
  const user = await db.query('SELECT * FROM users WHERE id = $1', [req.user.userId]);
  res.json({ user });
});

Session vs Token — Which Do You Pick?

💡 Recommendation:
├── SPA + API → JWT (access 15min + refresh 7d)
├── Traditional web (SSR) → Session (Redis-backed)
├── Mobile app → JWT
└── Both → JWT for API, Session for admin panel

---

🌐 OAuth 2.0 — "Login with Google/GitHub"

OAuth 2.0 is the standard that lets users sign in with an account from another provider (Google, GitHub, Facebook and so on) without ever handing us a password. It is the safer arrangement, because we never have to manage passwords and the user never has to remember a new one.

Why OAuth is safe: throughout the process the user never gives their password to us — they give it to Google/GitHub directly. All we receive is an Authorization Code, which we exchange for an Access Token that reaches only the basics (email, name).

The core OAuth 2.0 Authorization Code Flow is the most secure of the flows and the right fit for web applications, but it does require a backend server — to hold the client secret (never expose it on the frontend!) and to exchange the authorization code for an access token.

OAuth Database Schema: to support multiple OAuth providers, design the database so that one user can hold several auth methods — signing in with email+password, Google OAuth and GitHub OAuth, all on the same account.

The good approach is a separate user_auth_providers table holding the mapping between a user and each provider, together with the provider_id and the access/refresh tokens (which must be encrypted before storage!). That is far more flexible than bolting `google_id`, `facebook_id` columns onto the users table.

OAuth Implementation with Passport.js

// ═══════════════════════════════
// Google OAuth 2.0 — Passport.js
// ═══════════════════════════════
import passport from 'passport';
import { Strategy as GoogleStrategy } from 'passport-google-oauth20';

passport.use(new GoogleStrategy(
  {
    clientID: process.env.GOOGLE_CLIENT_ID,
    clientSecret: process.env.GOOGLE_CLIENT_SECRET,
    callbackURL: '/api/auth/google/callback',
  },
  async (accessToken, refreshToken, profile, done) => {
    try {
      // Find or create user
      let user = await db.query(
        'SELECT * FROM users WHERE google_id = $1 OR email = $2',
        [profile.id, profile.emails[0].value]
      );

      if (!user.rows.length) {
        // Create new user
        user = await db.query(
          `INSERT INTO users (google_id, email, name, avatar_url, email_verified)
           VALUES ($1, $2, $3, $4, true) RETURNING *`,
          [profile.id, profile.emails[0].value, profile.displayName, profile.photos[0]?.value]
        );
      } else if (!user.rows[0].google_id) {
        // Link Google account to existing user
        await db.query(
          'UPDATE users SET google_id = $1, avatar_url = COALESCE(avatar_url, $2) WHERE id = $3',
          [profile.id, profile.photos[0]?.value, user.rows[0].id]
        );
      }

      done(null, user.rows[0]);
    } catch (err) {
      done(err, null);
    }
  }
));

// Routes
app.get('/api/auth/google',
  passport.authenticate('google', {
    scope: ['profile', 'email']
  })
);

app.get('/api/auth/google/callback',
  passport.authenticate('google', { session: false }),
  (req, res) => {
    // Generate YOUR JWT
    const { accessToken, refreshToken } = generateTokens(req.user);

    // Redirect to frontend with token
    res.redirect(`${FRONTEND_URL}/auth/callback?token=${accessToken}`);
  }
);

// ═══════════════════════════════
// GitHub OAuth — Passport.js
// ═══════════════════════════════
import { Strategy as GitHubStrategy } from 'passport-github2';

passport.use(new GitHubStrategy(
  {
    clientID: process.env.GITHUB_CLIENT_ID,
    clientSecret: process.env.GITHUB_CLIENT_SECRET,
    callbackURL: '/api/auth/github/callback',
    scope: ['user:email'],
  },
  async (accessToken, refreshToken, profile, done) => {
    const email = profile.emails?.[0]?.value;

    let user = await findOrCreateUser({
      github_id: profile.id,
      email: email,
      name: profile.displayName || profile.username,
      avatar_url: profile.photos[0]?.value,
    });

    done(null, user);
  }
));

app.get('/api/auth/github',
  passport.authenticate('github', { scope: ['user:email'] })
);

app.get('/api/auth/github/callback',
  passport.authenticate('github', { session: false }),
  (req, res) => {
    const { accessToken } = generateTokens(req.user);
    res.redirect(`${FRONTEND_URL}/auth/callback?token=${accessToken}`);
  }
);

Database Schema for OAuth

CREATE TABLE users (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  email VARCHAR(255) UNIQUE NOT NULL,
  name VARCHAR(100),
  avatar_url VARCHAR(500),
  password_hash VARCHAR(255),       -- NULL if the account logs in via OAuth only
  email_verified BOOLEAN DEFAULT false,

  -- OAuth provider IDs
  google_id VARCHAR(255) UNIQUE,
  github_id VARCHAR(255) UNIQUE,
  facebook_id VARCHAR(255) UNIQUE,

  role VARCHAR(20) DEFAULT 'member',
  created_at TIMESTAMPTZ DEFAULT NOW(),
  updated_at TIMESTAMPTZ DEFAULT NOW()
);

-- Allow multiple auth methods per user
CREATE TABLE user_auth_providers (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  user_id UUID NOT NULL REFERENCES users(id) ON DELETE CASCADE,
  provider VARCHAR(50) NOT NULL,     -- 'google', 'github', 'email'
  provider_id VARCHAR(255) NOT NULL, -- Provider's user ID
  access_token TEXT,                  -- Encrypted!
  refresh_token TEXT,                 -- Encrypted!
  token_expires_at TIMESTAMPTZ,
  created_at TIMESTAMPTZ DEFAULT NOW(),

  UNIQUE(provider, provider_id)
);

---

🔒 Multi-Factor Authentication (MFA/2FA)

Multi-Factor Authentication (MFA), or 2FA, is an extra layer of defense requiring "something you know" (a password) plus "something you have" (your phone). Even if the password leaks, the attacker still cannot get in, because they do not have your phone.

TOTP (Time-based One-Time Password) works by combining a shared secret key with the current timestamp to produce a six-digit code that changes every 30 seconds. The scheme works even with no internet connection, because the server and the authenticator app are reading the same clock.

⚠️ Even if password is stolen: the attacker still needs the physical phone to read the code!

QR Code Setup: the first time a user turns MFA on, the server generates a secret key and renders it as a QR code carrying the service name, the user's email and the secret key. The user scans that QR code with Google Authenticator or Authy to save the secret.

Backup codes matter enormously! Generate backup codes (say, 10 single-use codes) for the user to keep somewhere safe, in case the phone is lost or the authenticator app breaks. Those backup codes must be hashed before they are stored in the database, exactly like a password.

TOTP Implementation

// ═══════════════════════════════
// TOTP Implementation — speakeasy
// ═══════════════════════════════
import speakeasy from 'speakeasy';
import qrcode from 'qrcode';

// 1. Generate secret for user
app.post('/api/auth/mfa/setup', authenticate, async (req, res) => {
  const secret = speakeasy.generateSecret({
    name: `MyApp (${req.user.email})`,
    issuer: 'MyApp',
    length: 32,
  });

  // Store secret temporarily (verify before enabling)
  await db.query(
    'UPDATE users SET mfa_secret_temp = $1 WHERE id = $2',
    [secret.base32, req.user.userId]
  );

  // Generate QR code
  const qrCodeUrl = await qrcode.toDataURL(secret.otpauth_url);

  res.json({
    qrCode: qrCodeUrl,        // Display to user
    manualKey: secret.base32,  // Manual entry fallback
  });
});

// 2. Verify and enable MFA
app.post('/api/auth/mfa/verify', authenticate, async (req, res) => {
  const { code } = req.body;

  const user = await db.query(
    'SELECT mfa_secret_temp FROM users WHERE id = $1',
    [req.user.userId]
  );

  const isValid = speakeasy.totp.verify({
    secret: user.rows[0].mfa_secret_temp,
    encoding: 'base32',
    token: code,
    window: 1,  // Allow 1 step before/after (±30 sec)
  });

  if (!isValid) {
    return res.status(400).json({ error: 'Invalid code' });
  }

  // Generate backup codes
  const backupCodes = Array.from({ length: 10 }, () =>
    Math.random().toString(36).substring(2, 10).toUpperCase()
  );

  // Enable MFA
  await db.query(
    `UPDATE users SET
       mfa_enabled = true,
       mfa_secret = mfa_secret_temp,
       mfa_secret_temp = NULL,
       mfa_backup_codes = $1
     WHERE id = $2`,
    [JSON.stringify(backupCodes.map(c => bcrypt.hashSync(c, 10))), req.user.userId]
  );

  res.json({
    message: 'MFA enabled!',
    backupCodes,  // Show ONCE, user must save them
  });
});

// 3. Login with MFA
app.post('/api/auth/login', async (req, res) => {
  const { email, password, mfaCode } = req.body;

  // Step 1: Verify password
  const user = await verifyCredentials(email, password);

  // Step 2: Check if MFA enabled
  if (user.mfa_enabled) {
    if (!mfaCode) {
      return res.status(200).json({
        requiresMfa: true,
        message: 'Please enter your 2FA code'
      });
    }

    // Verify TOTP code
    const isValid = speakeasy.totp.verify({
      secret: user.mfa_secret,
      encoding: 'base32',
      token: mfaCode,
      window: 1,
    });

    if (!isValid) {
      // Check backup codes
      const isBackup = await verifyBackupCode(user.id, mfaCode);
      if (!isBackup) {
        return res.status(401).json({ error: 'Invalid 2FA code' });
      }
    }
  }

  // Step 3: Issue tokens
  const tokens = generateTokens(user);
  res.json(tokens);
});

---

🛡️ Authorization — RBAC, ABAC, Permissions

Once Authentication has succeeded, the next step is Authorization — deciding what this particular user is allowed to do. RBAC (Role-Based Access Control) is the most widely used model: you define Roles, and each Role carries a set of Permissions.

How RBAC works: instead of granting permissions to a user directly, you grant the user a Role, and that Role carries one bundle of permissions. This is far easier to manage — when you want a user to become an editor, you change a single role instead of editing permissions one at a time.

Principle of Least Privilege: grant the smallest set of rights the work requires — a member should not be able to delete someone else's post, an editor should not be managing user accounts. Have middleware check both the permission and the ownership (who owns the resource).

Role-Based Access Control (RBAC)

A flexible RBAC database schema: designing the database for RBAC means thinking ahead — a user may hold several roles, and a role may carry complicated permissions. The best approach is separate tables: `roles`, `permissions`, `role_permissions` (many-to-many), `user_roles` (many-to-many)

Middleware Pattern: in Express.js, write middleware functions such as `requirePermission('posts:update')` and `requireOwnership('user_id')` to check the rights before the route is reached. It keeps the code readable, and it guarantees that every endpoint checks permissions.

RBAC Implementation

// ═══════════════════════════════
// Permission-based RBAC
// ═══════════════════════════════

const PERMISSIONS = {
  admin: [
    'users:read', 'users:create', 'users:update', 'users:delete',
    'posts:read', 'posts:create', 'posts:update', 'posts:delete',
    'settings:read', 'settings:update',
    'analytics:read',
  ],
  editor: [
    'posts:read', 'posts:create', 'posts:update', 'posts:delete',
    'analytics:read',
  ],
  member: [
    'posts:read', 'posts:create',  // Can create own posts
  ],
  guest: [
    'posts:read',                   // Read-only
  ],
};

// Middleware: Check permission
function requirePermission(...requiredPermissions) {
  return (req, res, next) => {
    const userRole = req.user.role;
    const userPermissions = PERMISSIONS[userRole] || [];

    const hasPermission = requiredPermissions.every(
      perm => userPermissions.includes(perm)
    );

    if (!hasPermission) {
      return res.status(403).json({
        error: 'Forbidden',
        message: `Required: ${requiredPermissions.join(', ')}`,
        yourRole: userRole,
      });
    }

    next();
  };
}

// Middleware: Check resource ownership
function requireOwnership(resourceField = 'user_id') {
  return async (req, res, next) => {
    // Admins bypass ownership check
    if (req.user.role === 'admin') return next();

    const resource = await db.query(
      `SELECT ${resourceField} FROM ${req.resourceTable} WHERE id = $1`,
      [req.params.id]
    );

    if (resource.rows[0]?.[resourceField] !== req.user.userId) {
      return res.status(403).json({ error: 'Not your resource' });
    }

    next();
  };
}

// ═══════════════════════════════
// Routes with RBAC
// ═══════════════════════════════

// Anyone can read posts
app.get('/api/posts',
  authenticate,
  requirePermission('posts:read'),
  getPosts
);

// Members+ can create posts
app.post('/api/posts',
  authenticate,
  requirePermission('posts:create'),
  createPost
);

// Editors+ can update any post, members only own posts
app.put('/api/posts/:id',
  authenticate,
  requirePermission('posts:update'),
  requireOwnership('user_id'),  // Editors bypass, members checked
  updatePost
);

// Admin-only routes
app.get('/api/admin/users',
  authenticate,
  requirePermission('users:read'),
  listUsers
);

app.delete('/api/admin/users/:id',
  authenticate,
  requirePermission('users:delete'),
  deleteUser
);

Database Schema for RBAC (Advanced)

-- ═══════════════════════════════
-- Flexible RBAC with DB
-- ═══════════════════════════════

CREATE TABLE roles (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  name VARCHAR(50) UNIQUE NOT NULL,  -- admin, editor, member
  description TEXT,
  is_default BOOLEAN DEFAULT false,   -- Default role for new users
  created_at TIMESTAMPTZ DEFAULT NOW()
);

CREATE TABLE permissions (
  id UUID DEFAULT gen_random_uuid() PRIMARY KEY,
  name VARCHAR(100) UNIQUE NOT NULL,  -- posts:create, users:delete
  description TEXT,
  resource VARCHAR(50) NOT NULL,       -- posts, users, settings
  action VARCHAR(50) NOT NULL,         -- create, read, update, delete
  created_at TIMESTAMPTZ DEFAULT NOW(),

  UNIQUE(resource, action)
);

CREATE TABLE role_permissions (
  role_id UUID REFERENCES roles(id) ON DELETE CASCADE,
  permission_id UUID REFERENCES permissions(id) ON DELETE CASCADE,
  PRIMARY KEY (role_id, permission_id)
);

CREATE TABLE user_roles (
  user_id UUID REFERENCES users(id) ON DELETE CASCADE,
  role_id UUID REFERENCES roles(id) ON DELETE CASCADE,
  PRIMARY KEY (user_id, role_id)
);

-- ═══════════════════════════════
-- Query: Get user permissions
-- ═══════════════════════════════
SELECT DISTINCT p.name as permission
FROM users u
JOIN user_roles ur ON u.id = ur.user_id
JOIN roles r ON ur.role_id = r.id
JOIN role_permissions rp ON r.id = rp.role_id
JOIN permissions p ON rp.permission_id = p.id
WHERE u.id = $1;

---

🔐 Security Best Practices — Checklist

An Authentication/Authorization system has a great many attack vectors, so the defense has to cover every side of it: brute force, SQL injection, XSS, CSRF, token theft. Leave one gap and the whole of your security collapses.

Common Attacks & Prevention

Rate Limiting: every endpoint needs a rate limit that suits it — the login endpoint gets the strictest one (5 attempts / 15 minutes) because it is what brute force aims at; ordinary API endpoints run at 100 requests / 15 minutes; password reset has to be capped to prevent DoS.

Input Validation: validate every input — type, length and format — and use a whitelist rather than a blacklist: an email has to match the regex pattern, a password has to carry an uppercase letter, a lowercase letter, a number and a special character.

Security Headers with Helmet: Helmet.js sets the security headers that matter — Content Security Policy (CSP) blocks XSS by restricting where the browser may load scripts from, HSTS forces HTTPS, and X-Frame-Options prevents clickjacking.

CORS Configuration: keep CORS strict — name the permitted origins explicitly (never the wildcard *), declare the allowed headers, and set credentials: true for cookies, but watch out for the preflight cache.

Rate Limiting

// ═══════════════════════════════
// Rate Limiting — express-rate-limit
// ═══════════════════════════════
import rateLimit from 'express-rate-limit';

// General API rate limit
const apiLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,  // 15 minutes
  max: 100,                   // 100 requests per window
  message: { error: 'Too many requests, try again later' },
  standardHeaders: true,
  legacyHeaders: false,
});
app.use('/api/', apiLimiter);

// Strict login rate limit
const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000,  // 15 minutes
  max: 5,                     // 5 login attempts
  skipSuccessfulRequests: true,
  message: { error: 'Too many login attempts. Try again in 15 minutes.' },
});
app.use('/api/auth/login', loginLimiter);

// Password reset rate limit
const resetLimiter = rateLimit({
  windowMs: 60 * 60 * 1000,  // 1 hour
  max: 3,                     // 3 reset requests per hour
});
app.use('/api/auth/reset-password', resetLimiter);

Security Headers

// ═══════════════════════════════
// Helmet.js — Security Headers
// ═══════════════════════════════
import helmet from 'helmet';

app.use(helmet({
  contentSecurityPolicy: {
    directives: {
      defaultSrc: ["'self'"],
      scriptSrc: ["'self'"],
      styleSrc: ["'self'", "'unsafe-inline'"],
      imgSrc: ["'self'", "data:", "https:"],
      connectSrc: ["'self'", "https://api.myapp.com"],
    },
  },
  hsts: {
    maxAge: 31536000,      // 1 year
    includeSubDomains: true,
    preload: true,
  },
  referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
}));

// CORS configuration
import cors from 'cors';

app.use(cors({
  origin: ['https://myapp.com', 'https://admin.myapp.com'],
  methods: ['GET', 'POST', 'PUT', 'DELETE'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  credentials: true,
  maxAge: 86400,  // Preflight cache 24h
}));

---

🏢 Single Sign-On (SSO) — Enterprise

SSO = sign in once → every app in the organization lets you in

Single Sign-On is the standard for large organizations, so that staff do not have to remember several passwords and the IT team can manage user accounts from a single place. When an employee leaves, you close one account and every system is shut to them at once.

SAML vs OIDC: SAML 2.0 is the older standard, XML-based and complicated, but it covers the full set of enterprise features. OpenID Connect (OIDC) is the newer standard, built on top of OAuth 2.0, using JSON/JWT that is much easier to read — a better fit for modern applications.

Popular Providers: Okta, Auth0 (by Okta), Azure AD (Microsoft Entra ID), Google Workspace, Keycloak (open-source), AWS Cognito

---

📊 Complete Authentication Architecture — The Whole Picture

A complete Authentication/Authorization system is built out of several layers: Frontend (handles the UX + stores tokens), API Gateway/Backend (verifies tokens + enforces permissions), Database (stores users, roles, sessions)

Frontend Layer: shows the login form, handles the OAuth redirects, keeps the access token in memory (not in localStorage, to guard against XSS), uses Axios interceptors to attach the Bearer token to every request, and handles 401 errors with an automatic token refresh.

API Gateway Layer: rate limiting comes first, followed by CORS + security headers, then the auth middleware that checks the JWT signature, then the RBAC middleware that checks permissions — only then does the request reach the business logic.

Database Layer: the users table holds the basic info + password hash + MFA settings, the refresh_tokens table holds the valid tokens (for revocation), the roles/permissions tables serve RBAC, and the login_attempts table tracks brute force.

---

🔑 Key Takeaways