Authentication and

Authorization Systems
What is Authentication?
• The authentication process refers to verifying someone’s identity or determining
that they are who they claim to be.
• For instance, if you need to gain access to a system and you are required to fill out
your username and password, these are checked against a specific database
following your input. After this step, if the submitted data matches, you are granted
system access.
• Another example of authentication would be when two devices are set in different
locations and initiate communication. Through authentication, these basically
establish a trust level.
The term authentication to describe a flow that allows a system to identify a user. In other
words, authentication systems tell us that “joe123” is actually “joe123” and not
“susan1988.”
What is Authorization?
• Authorization is the process of granting someone permission to do something or
access a certain resource after checking their level of access and after the
authentication process is completed. This permission can be granted by a person or
an automated system. Authorization is usually done with the goal of preventing
unauthorized access to resources.
• For instance, you may be authorized to use standard apps at your job, but you
might not be authorized to use some applications reserved only for admins. To gain
access to restricted areas you should be authorized through a privileged access
management system for example, that assigns you limited privileged permissions.

The term authorization is used to describe a flow inside a system for determining what
resources “joe123” has access to, as opposed to “susan1988.” For example, “joe123” should
be able to access his own uploaded private photos, and “susan1988” should be able to
access hers, but they should not be able to access each other’s photos.
 Popular Authentication Techniques-
• Password-Based Authentication
• Passwordless Authentication
• 2FA/MFA (Two-Factor Authentication / Multi-Factor
Authentication)
• Single sign-on (SSO)
• Social authentication

Popular Authorization Techniques-

• Role-Based Access Controls (RBAC)
• JSON web token (JWT) Authorization
• SAML Authorization
• OpenID Authorization
• OAuth 2.0 Authorization
Why are Authentication and Authorization
important?
The main goal of authentication and authorization working together is to prevent
cyberattacks that involve data breaches. Thus, authentication and authorization
combined are important because:
• limits data breaches by securing the organization’s network at a granular level
through centralized access controls (especially through authorization);
• has a focus on privileged access and its scope;
• prevents financial and reputational damage;
• permissions limit the activities and the information a user can have access to and
limits thus lateral movement across the network if a hacker had gained access to a
compromised account;
• helps detect unauthorized activity on a network;
• user productivity is managed and enhanced;
• helps you meet compliance.
Authentication
• Early authentication systems were simple in nature. For example, HTTP
basic authentication performs authentication by attaching an
Authorization header on each request.
• The header consists of a string containing Basic: <base64-encoded
user name:password>. The server receives the username:password
combination and, on each request, checks it against the database.
• Obviously, this type of authentication scheme has several flaws—for
example, it is very easy for the credentials to be leaked in a number
of ways, from compromised WiFi over HTTP to simple XSS attacks.
Authentication
• Later authentication developments include digest authentication, which
employs cryptographic hashes instead of base64 encoding.
• After digest authentication, a multitude of new techniques and architectures
popped up for authentication, including those that do not involve passwords
or require external devices.
• Today, most web applications choose from a suite of authentication
architectures, depending on the nature of the business. For example, the
OAuth protocol is great for websites that want to integrate with larger
websites.
• OAuth allows for a major website (such as Facebook, Google, etc.) to
provide a token verifying a user’s identity to a partner website.
Authentication
• OAuth can be useful to a user because the user’s data only needs to be
updated on one site, rather than on multiple sites—but OAuth can be
dangerous because one compromised website can result in multiple
compromised profiles.
• HTTP basic authentication and digest authentication are still used
widely today, with digest being more popular as it has more defenses
against interception and replay attacks.
• Often these are coupled with tools like 2FA to ensure that
authentication tokens are not compromised, and that the identity of
the logged-in user has not changed.
The Evolution of Authentication Methods
The Evolution of Authentication Methods
• The conventional approach of username and password is now
augmented by token-based authentication. Tokens, being self-contained
units, revolutionize the user verification process, reducing the
dependency on repeated database queries during user interactions.
• JSON Web Tokens (JWTs) stand out as a beacon in the realm of token-
based authentication. Comprising a header, payload, and signature,
JWTs offer a compact yet robust solution for transmitting crucial user
information.
How to Generate a JWT in [Link] How to Verify a JWT in [Link]
javascript javascript
const jwt = require(‘jsonwebtoken’); try {
const decodedUser = [Link](token,
const secretKey = ‘your-secret-key’; secretKey);
const user = { id: 123, username: [Link](‘Decoded User:’,
‘example_user’ }; decodedUser);
} catch (error) {
const token = [Link](user, secretKey, {
expiresIn: ‘1h’ }); [Link](‘Token verification
failed:’, [Link]);
[Link](‘Generated JWT:’, token); }

These examples not only generate and verify JWTs but symbolize the transition
from traditional to token-based authentication.
Authorization
• Authorization is the next step after authentication. Authorization
systems are more difficult to categorize, as authorization very much
depends on the business logic inside of the web application.
• Well-designed applications have a centralized authorization class that
is responsible for determining if a user has access to certain resources
or functionality.
• If APIs are poorly written, they will implement checks on a per-API
basis, which manually reproduce authorization functionality.
Authorization
• Oftentimes, if you can tell that an application reimplements
authorization checks in each API, that application will likely have
several APIs where the checks are not sufficient simply due to human
error.
• Some common resources that should always have authorization checks
include settings/ profile updates, password resets, private message
reads/writes, any paid functionality, and any elevated user
functionality (such as moderation functions).
Web Servers
Web Servers
• A modern client-server web application relies on a number of
technologies built on top of each other for the server-side component
and client-side components to function as intended.
• In the case of the server, application logic runs on top of a software-
based web server package so that application developers do not
have to worry about handling requests and managing processes. The
web server software, of course, runs on top of an operating system
(usually some Linux distro like Ubuntu, CentOS, or RedHat), which runs
on top of physical hardware in a data center somewhere.
• But as far as web server software goes, there are a few big players in
the modern web application world. Apache still serves nearly half of
the websites in the world, so we can assume Apache serves the
majority of web applications as well.
• Apache is open source, has been in development for around 25 years,
and runs on almost every Linux distro, as well as some Windows
servers

Apache, one of the largest and most frequently implemented web server software packages, has been in
development since 1995
• Apache is great not only due to its large community of contributors and
open source nature, but also because of how easily configurable and
pluggable it has become.
• It’s a flexible web server that you will likely see for a long time.
• Apache’s biggest competitor is Nginx. Nginx runs around 30% of web
servers and is growing rapidly.
• Although Nginx can be used for free, its parent company (F5 Networks)
uses a paid+ model where support and additional functionality come
at a cost.
• Nginx is used for high-volume applications with a large number of
unique connections, as opposed to those with few connections requiring
a lot of data.
• Web applications that are serving many users simultaneously may see
large performance improvements when switching from Apache to
Nginx, as the Nginx architecture has much less overhead per
connection.
Apache vs Nginx
• Behind Nginx is Microsoft IIS, although the popularity of Windows-
based servers has diminished due to expensive licenses and lack of
compatibility with Unix-based open source software (OSS) packages.
• IIS is the correct choice of web server when dealing with many
Microsoft-specific technologies, but may be a burden to companies
trying to build on top of open source.
• There are many smaller web servers out there, and each has its own
security benefits and downsides.
Apache Web Server
IIS vs Apache vs NGINX: Advantages of Apache
• As it open source, so there are no licensing fees.
• It is flexible, meaning that you can choose the modules you want.
• Has a high level of security.
• Strong user community to provide backend support.
• Runs equally well on UNIX, Linux, MacOS, Windows.
IIS vs Apache vs NGINX: Disadvantage of Apache
• It is a process based server, hence has the scope of having an
overhead because of thread characteristics.
NGINX Web Server
IIS vs Apache vs NGINX: Advantages of NGINX
• Open source.
• A high speed web server which can be used as a reverse-proxy server.
• Can be used better in a virtual private server environment.
Disadvantage of NGINX:
• Has less support from developer community and documentation as
compared to Apache.
Microsoft IIS Web Server
IIS vs Apache vs NGINX: Advantages of IIS
• Has the support of Microsoft.
• You can have access to the .NET framework along with ASPX scripts.
• Can be easily integrated with other Microsoft services like ASP, MS
SQL etc.
IIS vs Apache vs NGINX: Disadvantage of IIS:
• Is not as much customisable like open-source web servers, so you might
face an issue there.

More details: NGINX vs Apache: Head to Head Comparison

[Link]
[Link]
Server-Side Databases
Server-Side Databases
• Once a client sends data to be processed to a server, the server must
often persist this data so that it can be retrieved in a future session.
• Storing data in memory is not reliable in the long term, as restarts and
crashes could cause data loss. Additionally, random-access memory is
quite expensive when compared to disk.
• When storing data on disk, proper precautions need to be taken to
ensure that the data can be reliably and quickly retrieved, stored,
and queried.
• Almost all of today’s web applications store their user-submitted data
in some type of database—often varying the database used
depending on the particular business logic and use case.
• SQL databases are still the most popular general-purpose database
on the market.
• SQL query language is strict, but reliably fast and easy to learn. SQL
can be used for anything from storage of user credentials to managing
JSON objects or small image blobs. The largest of these are
PostgreSQL, Microsoft SQL Server, MySQL, and SQLite.
• When more flexible storage is needed, schema-less NoSQL
databases can be employed. Databases like MongoDB, DocumentDB,
and CouchDB store information as loosely structured “documents”
that are flexible and can be modified at any time, but are not as easy
or efficient at querying or aggregating.
• In today’s web application landscape, more advanced and particular
databases also exist.
• Search engines often employ their own highly specialized databases
that must be synchronized with the main database on a regular basis.
An example of this is the widely popular Elasticsearch.
• Each type of database carries unique challenges and risks. SQL
injection is a wellknown vulnerability archetype effective against
major SQL databases when queries are not properly formed.
• However, injection-style attacks can occur against almost any database
if a hacker is willing to learn the database’s query model. It is wise to
consider that many modern web applications can employ multiple
databases at the same time, and often do.
• Applications with sufficiently secure SQL query generation may not
have sufficiently secure MongoDB or Elasticsearch queries and
permissions.
Client-Side Data Stores
Client-Side Data Stores
• Traditionally, minimal data is stored on the client because of technical
limitations and cross-browser compatibility issues. This is rapidly
changing.
• Many applications now store significant application state on the client,
often in the form of configuration data or large scripts that would
cause network congestion if they had to be downloaded on each visit.
• In most cases, a browser-managed storage container called local
storage is used for storing and accessing key/value data from the
client.
• Local storage follows browser enforced Same Origin Policy (SOP),
which prevents other domains (websites) from accessing each other’s
locally stored data. Web applications can maintain state even when
the browser or tab is closed
• A subset of local storage called session storage operates identically,
but persists data only until the tab is closed. This type of storage can
be used when data is more critical and should not be persisted if
another user uses the same machine.
• Finally, for more complex applications, browser support for IndexedDB
is found in all major web browsers today.
• IndexedDB is a JavaScript-based object oriented programming (OOP)
database capable of storing and querying asynchronously in the
background of a web application.
• Because IndexedDB is queryable, it offers a much more powerful
developer interface than local storage is capable of.
• IndexedDB finds use in web-based games and web-based interactive
applications (like image editors).
• You can check if your browser supports IndexedDB by typing the
following in the browser developer console:
if ([Link]) {
[Link]('true');
}.