🔐 Authentication Models and Workflows

What Authentication Really Is

Authentication is the process of verifying that users are who they claim to be — the digital equivalent of checking someone's ID at the door. It is easy to confuse with its close cousin, authorization, but they answer different questions.

Every authentication system, no matter how it is built, has to answer three questions:

• Identity: Who is the user claiming to be?
• Proof: How do they prove that claim?
• Persistence: How do we remember they proved it, so they aren't asked on every click?

💡 A useful analogy: Authentication is like entering a country. Your passport establishes your identity, the immigration officer verifies it's really you (proof), and the entry stamp lets you move around without being re-checked at every corner (persistence). The rest of this lesson is really about that last part — how different systems issue and honor the "stamp."

Authentication Factors & MFA

An authentication factor is a category of proof. Security professionals group them into four families, and combining families is what makes an account genuinely hard to break into.

Multi-factor authentication (MFA) requires proof from two different families — the classic example is an ATM: your card (something you have) plus your PIN (something you know). Two passwords are not MFA, because they belong to the same family.

The most common second factor today is TOTP (Time-based One-Time Password) — the six-digit code your authenticator app rotates every 30 seconds. Here is how a server issues and verifies one:

// Node.js — TOTP setup and verification with otplib
const { authenticator } = require('otplib');
const QRCode = require('qrcode');

// 1. During MFA setup: generate a secret unique to this user
async function beginMfaSetup(user) {
  const secret = authenticator.generateSecret();         // store this (encrypted!) on the user
  const otpauth = authenticator.keyuri(user.email, 'MyApp', secret);
  const qrDataUrl = await QRCode.toDataURL(otpauth);     // user scans this in their app
  return { secret, qrDataUrl };
}

// 2. On every login attempt after MFA is enabled: verify the 6-digit code
function verifyMfa(secret, userSuppliedCode) {
  // otplib allows a small time window to tolerate clock drift
  return authenticator.check(userSuppliedCode, secret);  // true / false
}

Password-Based Authentication

Despite decades of predictions of their death, passwords remain the most common credential. The danger is almost never the password itself — it's how the server stores it.

Think of hashing like a meat grinder: you can turn a steak into ground beef, but you can never reconstruct the steak. A stolen database of properly hashed passwords is far less useful to an attacker than one of plaintext passwords.

Modern libraries such as bcrypt generate the salt for you and embed it inside the output, so you store a single string:

const bcrypt = require('bcrypt');
const SALT_ROUNDS = 12; // higher = slower = harder to brute-force

// Hash at registration time
async function hashPassword(plain) {
  return bcrypt.hash(plain, SALT_ROUNDS); // salt is generated and embedded automatically
}

// Compare at login time — bcrypt extracts the salt from the stored hash
async function verifyPassword(plain, storedHash) {
  return bcrypt.compare(plain, storedHash); // resolves to true or false
}

Checking password strength

Length beats complexity. Rather than forcing arbitrary "one uppercase, one symbol" rules, estimate real-world guessability and reject weak choices. The zxcvbn library scores a password from 0 (terrible) to 4 (strong):

const zxcvbn = require('zxcvbn');

function validateStrength(password, userInputs = []) {
  // Pass known context (email, username) so those can't be reused as the password
  const result = zxcvbn(password, userInputs);
  if (result.score < 3) {
    return { ok: false, message: result.feedback.warning || 'Password is too weak',
             suggestions: result.feedback.suggestions };
  }
  return { ok: true };
}

You should also check candidate passwords against known-breach lists (for example, the "Have I Been Pwned" range API) so users cannot pick a password that has already leaked.

Session-Based Authentication

In the session model the server remembers who is logged in. After verifying credentials, the server creates a random session ID, stores the associated data server-side (in Redis, a database, or memory), and hands the client only the ID inside a cookie.

Because the cookie is sent automatically by the browser, an HttpOnly session cookie is invisible to JavaScript — which blunts XSS token theft. Here is a hardened Express setup backed by Redis:

const express = require('express');
const session = require('express-session');
const { RedisStore } = require('connect-redis');
const { createClient } = require('redis');

const app = express();
const redisClient = createClient({ url: 'redis://localhost:6379' });
redisClient.connect().catch(console.error);

app.use(session({
  store: new RedisStore({ client: redisClient }),
  secret: process.env.SESSION_SECRET,      // never hard-code this
  resave: false,
  saveUninitialized: false,
  cookie: {
    secure: process.env.NODE_ENV === 'production', // HTTPS only in prod
    httpOnly: true,                                // JS cannot read it
    sameSite: 'lax',                               // CSRF mitigation
    maxAge: 1000 * 60 * 60 * 24                     // 24 hours
  }
}));

app.post('/login', async (req, res) => {
  const user = await validateUser(req.body.username, req.body.password);
  if (!user) return res.status(401).json({ error: 'Invalid credentials' });

  // Regenerate the session ID on login to prevent session fixation
  req.session.regenerate((err) => {
    if (err) return res.status(500).json({ error: 'Authentication error' });
    req.session.userId = user.id;
    req.session.role = user.role;
    res.json({ message: 'Login successful' });
  });
});

app.post('/logout', (req, res) => {
  req.session.destroy(() => {
    res.clearCookie('connect.sid');
    res.json({ message: 'Logged out' });
  });
});

The mental model: a session cookie is like a concert wristband. You show your ticket once at the gate, get a wristband, and come and go freely — but the venue can cut the band off at any time.

Token-Based Authentication

In the token model the server holds no per-user state. After login it hands the client a signed token containing the user's identity. The client sends that token on every request, and the server trusts it because the signature proves it wasn't tampered with.

The dominant token format is the JWT (JSON Web Token): three base64url segments — header, payload, signature — joined by dots. The next lesson dissects JWTs in depth; here is the shape of an Express implementation:

const jwt = require('jsonwebtoken');
const bcrypt = require('bcrypt');
const JWT_SECRET = process.env.JWT_SECRET;

app.post('/api/login', async (req, res) => {
  const user = await findUserByUsername(req.body.username);
  if (!user || !(await bcrypt.compare(req.body.password, user.passwordHash))) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }
  const token = jwt.sign(
    { userId: user.id, role: user.role },   // payload (claims)
    JWT_SECRET,
    { expiresIn: '15m' }                     // keep access tokens short
  );
  res.json({ token });
});

// Middleware that protects routes
function authenticateToken(req, res, next) {
  const header = req.headers['authorization'];
  const token = header && header.split(' ')[1];  // "Bearer <token>"
  if (!token) return res.status(401).json({ error: 'Authentication required' });

  jwt.verify(token, JWT_SECRET, { algorithms: ['HS256'] }, (err, decoded) => {
    if (err) return res.status(403).json({ error: 'Invalid or expired token' });
    req.user = decoded;
    next();
  });
}

app.get('/api/profile', authenticateToken, (req, res) => {
  res.json({ userId: req.user.userId, role: req.user.role });
});

Analogy: a signed token is a printed ID badge with your photo and access level. Any guard can inspect it without phoning HQ — but if you lose it, it can't be remotely switched off; you just wait for it to expire.

The Refresh-Token Pattern

The refresh-token pattern resolves the tension between "tokens should be short-lived" and "users shouldn't log in every 15 minutes." You issue two tokens: a short-lived access token used on every request, and a long-lived refresh token whose only job is to mint new access tokens.

const crypto = require('crypto');

app.post('/api/login', async (req, res) => {
  const user = await validateUser(req.body.username, req.body.password);
  if (!user) return res.status(401).json({ error: 'Invalid credentials' });

  const accessToken = jwt.sign({ userId: user.id, role: user.role },
                               process.env.ACCESS_SECRET, { expiresIn: '15m' });

  // Refresh token: an opaque random string, stored hashed server-side
  const refreshToken = crypto.randomBytes(40).toString('hex');
  await storeRefreshToken({
    tokenHash: sha256(refreshToken),                 // never store it raw
    userId: user.id,
    expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000),
    userAgent: req.headers['user-agent']
  });

  res.json({ accessToken, refreshToken });
});

app.post('/api/refresh', async (req, res) => {
  const stored = await findRefreshToken(sha256(req.body.refreshToken));
  if (!stored || new Date() > stored.expiresAt) {
    return res.status(401).json({ error: 'Invalid or expired refresh token' });
  }
  // Rotation: invalidate the used token and issue a fresh pair
  await removeRefreshToken(stored.id);
  const newRefresh = crypto.randomBytes(40).toString('hex');
  await storeRefreshToken({ tokenHash: sha256(newRefresh), userId: stored.userId,
                            expiresAt: new Date(Date.now() + 30 * 24 * 60 * 60 * 1000) });
  const accessToken = jwt.sign({ userId: stored.userId },
                               process.env.ACCESS_SECRET, { expiresIn: '15m' });
  res.json({ accessToken, refreshToken: newRefresh });
});

Analogy: your access token is a hotel key card that expires each day; the refresh token is your reservation confirmation, which lets the front desk cut you a fresh card without checking you in again.

Social Login

Social authentication lets users sign in with an account they already have — Google, GitHub, Apple. Under the hood it uses OAuth 2.0 (covered two lessons from now); your app never sees the user's password, only a token and profile from the provider.

In Node, Passport.js wraps the provider-specific details behind a common strategy interface:

const passport = require('passport');
const GoogleStrategy = require('passport-google-oauth20').Strategy;

passport.use(new GoogleStrategy({
    clientID: process.env.GOOGLE_CLIENT_ID,
    clientSecret: process.env.GOOGLE_CLIENT_SECRET,
    callbackURL: '/auth/google/callback'
  },
  async (accessToken, refreshToken, profile, done) => {
    // Link to an existing account or create a new one
    let user = await findUserByProviderId('google', profile.id);
    if (!user) {
      user = await createUser({
        provider: 'google',
        providerId: profile.id,
        email: profile.emails[0].value,
        name: profile.displayName
      });
    }
    return done(null, user);
  }
));

app.get('/auth/google', passport.authenticate('google', { scope: ['profile', 'email'] }));
app.get('/auth/google/callback',
  passport.authenticate('google', { failureRedirect: '/login' }),
  (req, res) => res.redirect('/dashboard')
);

Hands-on Exercise

const express = require('express');
const bcrypt = require('bcrypt');
const jwt = require('jsonwebtoken');

const app = express();
app.use(express.json());
const SECRET = process.env.JWT_SECRET || 'dev-only-secret';
const users = []; // { id, username, passwordHash }

app.post('/register', async (req, res) => {
  const { username, password } = req.body;
  if (!username || !password) return res.status(400).json({ error: 'Missing fields' });
  if (users.some(u => u.username === username))
    return res.status(409).json({ error: 'Username taken' });

  const passwordHash = await bcrypt.hash(password, 12);
  const user = { id: users.length + 1, username, passwordHash };
  users.push(user);
  res.status(201).json({ id: user.id, username });
});

app.post('/login', async (req, res) => {
  const { username, password } = req.body;
  const user = users.find(u => u.username === username);
  if (!user || !(await bcrypt.compare(password, user.passwordHash)))
    return res.status(401).json({ error: 'Invalid credentials' });

  const token = jwt.sign({ userId: user.id }, SECRET, { expiresIn: '15m' });
  res.json({ token });
});

function authenticateToken(req, res, next) {
  const token = (req.headers.authorization || '').split(' ')[1];
  if (!token) return res.status(401).json({ error: 'Authentication required' });
  try {
    req.user = jwt.verify(token, SECRET, { algorithms: ['HS256'] });
    next();
  } catch {
    return res.status(403).json({ error: 'Invalid or expired token' });
  }
}

app.get('/me', authenticateToken, (req, res) => res.json({ userId: req.user.userId }));

app.listen(3000, () => console.log('Auth demo on http://localhost:3000'));

Best Practices

A quick rule of thumb for choosing a model:

• Server-rendered web app? Session cookies are simple and revocable.
• SPA or mobile app talking to an API? Access token in memory + refresh token in an HttpOnly cookie.
• Service-to-service? No user is involved — use client credentials (an OAuth flow, coming soon).
• Any sensitive account? Add MFA, and prefer passkeys where you can.

// Rate-limit the login route to blunt brute-force attacks
const rateLimit = require('express-rate-limit');

const loginLimiter = rateLimit({
  windowMs: 15 * 60 * 1000, // 15 minutes
  max: 5,                    // 5 attempts per window per IP
  standardHeaders: true,
  legacyHeaders: false,
  message: { error: 'Too many login attempts. Try again in 15 minutes.' }
});

app.post('/api/login', loginLimiter, loginHandler);

Summary & Quiz

📚 Further Reading

• OWASP — Authentication Cheat Sheet
• OWASP — Password Storage Cheat Sheet
• MDN — HTTP Authentication

🚀 What's Next?

You've seen where JWTs fit in the bigger picture. Next we go deep on JWT Authentication Implementation — dissecting the header, payload, and signature, and building a complete, production-shaped JWT system in Node.js.