Authen�ca�on vs Authoriza�on
1. Authen�ca�on
Defini�on:
Authen�ca�on is the process of verifying the iden�ty of a user. It answers the ques�on: “Who are you?”
The system checks whether the user is really who they claim to be before giving access.
Purpose:
To confirm a user’s iden�ty at the beginning of a session.
Common Methods:
• Username and Password
• One-Time Password (OTP) / Two-Factor Authen�ca�on (2FA)
• Biometrics (Fingerprint, Face ID, Re�na)
• OAuth Login (Google, Facebook, GitHub)
Types of Authen�ca�on Factors:
• Something you know — Password, PIN, Security Ques�ons
• Something you have — Security Token, Smart Card, Mobile OTP
• Something you are — Biometrics
Example:
When a user logs into an email account, they enter a username and password. The system verifies the
creden�als against stored data. If correct, the user becomes authen�cated.
2. Authoriza�on
Defini�on:
Authoriza�on is the process of determining what an authen�cated user is allowed to do. It answers the
ques�on: “What can you access?”
Purpose:
To control access to resources, features, or ac�ons a�er login.
Common Methods:
• Role-Based Access Control (RBAC)
• Atribute-Based Access Control (ABAC)
• Permission Policies
Example:
In a banking system:
• A normal user can view account balance.
• An admin can approve loans or manage users.
Authoriza�on checks occur every �me a user tries to access a protected resource.
3. Key Differences Between Authen�ca�on and Authoriza�on
Authen�ca�on Authoriza�on
Verifies iden�ty Grants permissions
Ques�on: “Who are you?” Ques�on: “What can you access?”
Happens before authoriza�on Happens a�er authen�ca�on
Login process Access control process
Example: Password verifica�on Example: Admin vs User permissions
4. Why Both Are Important
• Without authen�ca�on, anyone could pretend to be another user.
• Without authoriza�on, users could access data they should not be allowed to see.
Together:
• Authen�ca�on prevents unauthorized entry.
• Authoriza�on enforces security rules and least-privilege access. Password Hashing with bcrypt
Password Hashing with bcrypt
1. Defini�on
• Password hashing is a security technique used to store passwords safely in a database.
Instead of saving passwords as plain text, systems convert them into a hashed value that cannot
easily be reversed.
• bcrypt is a popular hashing algorithm designed specifically for passwords. It is inten�onally slow
and secure, which helps protect against brute-force atacks.
2. Why Hash Passwords?
• Plain text risk: If a database is leaked, atackers can see all passwords.
• Hashing protec�on: Converts a password into a fixed-length string.
• One-way process: The original password cannot be directly recovered from the hash.
• Salt included: Random data is added to prevent rainbow-table atacks.
• Stronger security: bcrypt is safer than older algorithms like MD5 or SHA-1.
3. How bcrypt Works
• Generate a unique random salt for each password.
• Combine the password with the salt.
• Apply the hashing algorithm mul�ple �mes based on a cost factor.
• Store the final hash in the database.
• Hash Format Example:
$2b$10$...
• $2b$ → Algorithm version
• 10 → Work factor (cost)
• Remaining part → Salt + Hashed password
• Login Process:
• User enters password.
• System hashes the input using the stored salt.
• If hashes match → authen�ca�on succeeds.
4. Cost Factor (Work Factor)
• Determines how many �mes hashing is repeated.
• Higher cost = stronger security but slower performance.
• Example: cost factor 12 may take around 0.3 seconds per hash.
5. Advantages of bcrypt
• Adap�ve security (cost factor can increase over �me)
• Built-in salt genera�on
• Resistant to brute-force and GPU atacks
• Designed specifically for password protec�on
• Easy to use in [Link] (bcrypt, bcryptjs)
6. Example
• Password: password123
Hashed Output Example:
$2b$12$KIXpA0L0b0z0z0z0z0z0z0z0z0z0z0z0z0z0