Skip to content
StackPractices

authentication

Practical resources about authentication for software engineers.

23 results

Securing Access to Your Systems

Authentication and authorization are the foundation of application security. From password hashing and JWT tokens to OAuth2 flows and multi-factor authentication, getting identity right protects both your users and your data.

These resources cover proven patterns for session management, API key handling, SSO with SAML, and role-based access control. Each guide explains when to use a given approach, common pitfalls to avoid, and complete implementation examples.

intermediate

Secure API Key Authentication for Services and Clients

How to generate, distribute, validate, and rotate API keys for machine-to-machine authentication using HMAC signatures, scopes, and rate-limited key policies.

beginner

Hash Passwords with Argon2

How to hash and verify passwords securely with Argon2id, the winner of the Password Hashing Competition, with correct parameter tuning and migration strategies from bcrypt.

advanced

Implement ABAC

How to implement attribute-based access control with policy engines, live context evaluation, and fine-grained authorization decisions across Python, Node.js, and Java.

intermediate

Implement RBAC

How to implement role-based access control with hierarchical roles, permission grants, and middleware enforcement across Python, Node.js, and Java.

advanced

Implement SSO with SAML

How to implement SAML 2.0 single sign-on as a Service Provider with XML signature verification, IdP metadata handling, and secure session management in Python, Node.js, and Java.

intermediate

JWT Authentication

How to generate, validate, and refresh JSON Web Tokens for stateless API authentication.

intermediate

Implement Passwordless Login with Magic Links

How to build secure passwordless authentication using time-limited magic links sent via email, with token generation, validation, and replay attack prevention.

intermediate

Node.js JWT Authentication: Verify and Refresh Tokens

Implement JWT authentication in Node.js with access and refresh tokens

intermediate

Node.js OAuth2 GitHub Login with Express

Implement GitHub OAuth2 login flow in Node.js with Express and Passport

intermediate

OAuth 2.0 Login

How to implement OAuth 2.0 authentication with Google, GitHub, and other providers.

intermediate

Password Hashing

How to securely hash and verify passwords using modern algorithms across Python, JavaScript, and Java.

intermediate

Implement Secure Session Management

How to create, validate, and expire user sessions securely across web applications using cookies, tokens, and server-side storage.

intermediate

Two-Factor Authentication (2FA / TOTP)

How to implement time-based one-time password (TOTP) two-factor authentication for secure user login.

intermediate

Store User Sessions in Memcached with Python

Use Memcached as a distributed session store in Python web applications with pymemcache, TTL management, and failover handling.

advanced

Field-Level Auth with Custom GraphQL Schema Directives

Implement field-level authorization in GraphQL using custom schema directives that check user roles and permissions per field

intermediate

Implement OAuth 2.0 PKCE for Single-Page Applications

How to implement the OAuth 2.0 PKCE flow in single-page applications to securely authenticate users without exposing client secrets

intermediate

Secure JWT Refresh Token Rotation with Python

Implement secure JWT access and refresh token rotation in Python with blacklist, reuse detection, and automatic access token renewal for stateless auth

advanced

Secure API Gateway with Custom Lambda Authorizers

Implement custom Lambda authorizers for API Gateway with JWT validation, IAM policy generation, and caching for token-based authentication in serverless APIs.

advanced

Federated Identity Pattern

Delegate authentication to external identity providers. A pattern for integrating OAuth2, OIDC, SAML, and SSO across multiple services and organizations.

advanced

Voucher Pattern

Validate claims and delegate access using signed vouchers without exposing sensitive data. A security pattern for token-based authorization between services.

advanced

Complete Guide to Authentication Patterns

Implement authentication in production. Covers JWT, OAuth2, session-based auth, passkeys, MFA, refresh tokens, token rotation, RBAC, ABAC, SSO with SAML and OpenID Connect, and secure logout patterns with practical code examples.

advanced

OAuth2 and OIDC: Authorization Code, PKCE, Token Validation

Master OAuth2 and OpenID Connect for production: authorization code flow with PKCE, token validation, refresh tokens, scopes, JWT verification, and security best practices.

intermediate

Security Best Practices Guide

A thorough guide to application security: authentication, authorization, input validation, secrets management, and common vulnerability prevention.