Authentication

0 lessons

1 system design

4 community items

authentication

System Design

1 article

Authentication & Authorization (OAuth2, JWT, RBAC)

Authentication answers 'who are you?'. Authorization answers 'what are you allowed to do?'. Most systems get both wrong in subtle ways: rolling their own crypto, treating JWTs as a session store, copying RBAC into every service, or never thinking about how to revoke a leaked credential. This lesson covers the standard building blocks: password storage with adaptive hashing, session vs token authentication, OAuth2 and OIDC flows, JWTs and their honest trade-offs, RBAC vs ABAC vs ReBAC, multi-tenant authorization at scale, machine-to-machine auth (API keys, mTLS, workload identity), and the operational concerns (key rotation, revocation, audit). The goal is to leave you able to design and defend the auth architecture for any system, from a single product to a federated multi-tenant platform.

295

Community

4 items

Code Snippet

Verify a JWT Without a JWT Library

How I verify HS256 JSON Web Tokens with the Web Crypto API and zero npm dependencies. Decodes the segments, checks the signature in constant time, and refuses to trust `alg: none`.

457

4.1 (9)

Apr 30, 2026

by @chidiweber

Article

JWT vs Sessions and When Stateless Bites Back

Sessions are the right default for first-party web apps. JWTs make sense at federation boundaries. Stateless is a property of where state lives, not whether it exists.

198

4.1 (10)

Feb 2, 2026

by @ninarossi

Article

OAuth2 and OpenID Connect: The Flows That Actually Matter

OAuth 2.0 is delegation. OpenID Connect is identity. Most bugs come from confusing the two. The four flows that matter, the eight checks I review, and what to never roll yourself.

579

4.2 (9)

Jan 2, 2026

by @arjunpatel

Code Snippet

Webhook Signature Verifier With Replay Protection

How I verify Stripe-style webhook signatures and stop someone from re-POSTing yesterday's `invoice.paid`. Stdlib HMAC, a tolerance window, and an idempotency cache that lives in any Redis-shaped store.

594

4.2 (10)

Nov 28, 2025

by @averyperry