authentication
Practical resources about authentication for software engineers.
23 results
Securing Access to Your Systems
Authentication and authorization are the foundation of application security. From password hashing and JWT tokens to OAuth2 flows and multi-factor authentication, getting identity right protects both your users and your data.
These resources cover proven patterns for session management, API key handling, SSO with SAML, and role-based access control. Each guide explains when to use a given approach, common pitfalls to avoid, and complete implementation examples.
Secure API Key Authentication for Services and Clients
How to generate, distribute, validate, and rotate API keys for machine-to-machine authentication using HMAC signatures, scopes, and rate-limited key policies.
Hash Passwords with Argon2
How to hash and verify passwords securely with Argon2id, the winner of the Password Hashing Competition, with correct parameter tuning and migration strategies from bcrypt.
Implement ABAC
How to implement attribute-based access control with policy engines, live context evaluation, and fine-grained authorization decisions across Python, Node.js, and Java.
Implement RBAC
How to implement role-based access control with hierarchical roles, permission grants, and middleware enforcement across Python, Node.js, and Java.
Implement SSO with SAML
How to implement SAML 2.0 single sign-on as a Service Provider with XML signature verification, IdP metadata handling, and secure session management in Python, Node.js, and Java.
JWT Authentication
How to generate, validate, and refresh JSON Web Tokens for stateless API authentication.
Implement Passwordless Login with Magic Links
How to build secure passwordless authentication using time-limited magic links sent via email, with token generation, validation, and replay attack prevention.
Node.js JWT Authentication: Verify and Refresh Tokens
Implement JWT authentication in Node.js with access and refresh tokens
Node.js OAuth2 GitHub Login with Express
Implement GitHub OAuth2 login flow in Node.js with Express and Passport
OAuth 2.0 Login
How to implement OAuth 2.0 authentication with Google, GitHub, and other providers.
Password Hashing
How to securely hash and verify passwords using modern algorithms across Python, JavaScript, and Java.
Implement Secure Session Management
How to create, validate, and expire user sessions securely across web applications using cookies, tokens, and server-side storage.
Two-Factor Authentication (2FA / TOTP)
How to implement time-based one-time password (TOTP) two-factor authentication for secure user login.
Store User Sessions in Memcached with Python
Use Memcached as a distributed session store in Python web applications with pymemcache, TTL management, and failover handling.
Field-Level Auth with Custom GraphQL Schema Directives
Implement field-level authorization in GraphQL using custom schema directives that check user roles and permissions per field
Implement OAuth 2.0 PKCE for Single-Page Applications
How to implement the OAuth 2.0 PKCE flow in single-page applications to securely authenticate users without exposing client secrets
Secure JWT Refresh Token Rotation with Python
Implement secure JWT access and refresh token rotation in Python with blacklist, reuse detection, and automatic access token renewal for stateless auth
Secure API Gateway with Custom Lambda Authorizers
Implement custom Lambda authorizers for API Gateway with JWT validation, IAM policy generation, and caching for token-based authentication in serverless APIs.
Federated Identity Pattern
Delegate authentication to external identity providers. A pattern for integrating OAuth2, OIDC, SAML, and SSO across multiple services and organizations.
Voucher Pattern
Validate claims and delegate access using signed vouchers without exposing sensitive data. A security pattern for token-based authorization between services.
Complete Guide to Authentication Patterns
Implement authentication in production. Covers JWT, OAuth2, session-based auth, passkeys, MFA, refresh tokens, token rotation, RBAC, ABAC, SSO with SAML and OpenID Connect, and secure logout patterns with practical code examples.
OAuth2 and OIDC: Authorization Code, PKCE, Token Validation
Master OAuth2 and OpenID Connect for production: authorization code flow with PKCE, token validation, refresh tokens, scopes, JWT verification, and security best practices.
Security Best Practices Guide
A thorough guide to application security: authentication, authorization, input validation, secrets management, and common vulnerability prevention.
No results found.