Web & APIs
Auth & Access Control: AuthN, AuthZ, Sessions & Tokens
Authentication proves who you are; authorization decides what you can do — separate concerns, enforced separately. Server-side sessions are stateful and instantly revocable; JWTs are stateless and scale, but are hard to revoke, so keep them short-lived with refresh tokens. Encrypt in transit and at rest, and hash passwords with bcrypt or argon2 — never plaintext or MD5.
Updated September 12, 2026 · 4 min read
AuthN vs AuthZ
| Authentication (AuthN) | Proving identity — who is this request from?Passwords, MFA, OAuth/OIDC login, mTLS. |
|---|
| Authorization (AuthZ) | Deciding permissions — what may this identity do?Enforce on every request, at every layer (defense in depth). |
|---|
| Keep them separate | A valid login never implies access. Check permissions per action, not just at the gateway. |
|---|
Sessions vs tokens (JWT)
| Server-side sessions | Session id in a cookie; state lives on the server/store.Instantly revocable; a lookup per request. |
|---|
| JWT (stateless) | Signed, self-contained token verified without a lookup.Scales across services; can’t be revoked before it expires. |
|---|
| Revocation is the catch | Keep access tokens short (minutes) + use refresh tokens; keep a denylist for logout/compromise.Never put anything you can’t tolerate being replayed-until-expiry in a long-lived JWT. |
|---|
| Cookie flags | HttpOnly, Secure, SameSite on anything in a cookie.Mitigates token theft via XSS and CSRF. |
|---|
OAuth 2.0 / OIDC & storage
| OAuth 2.0 | Delegated authorization — an app gets scoped access on your behalf.It’s authZ, not login. |
|---|
| OpenID Connect (OIDC) | An authentication layer on top of OAuth 2.0; adds an ID token.Use it when you need to know WHO the user is. |
|---|
| Passwords | Hash with bcrypt/argon2 + per-user salt.Never plaintext, MD5, or SHA-1; slow hashing resists offline cracking. |
|---|
| Encryption | TLS in transit; encrypt sensitive data at rest; secrets in a manager, not code.Rotate keys and credentials. |
|---|
Access-control models
| RBAC | Permissions attached to roles; users get roles.Simple, coarse-grained. |
|---|
| ABAC | Decisions from attributes (user, resource, context).Fine-grained; more complex. |
|---|
In the interview
- →Separate AuthN from AuthZ out loud, and enforce authorization on every request — a valid token is not a permission.
- →Own the sessions-vs-JWT trade-off: sessions for instant revocation, JWT for stateless scale — with short TTLs + refresh tokens to make JWT revocation tolerable.
- →Never hand-roll crypto or password hashing: bcrypt/argon2, TLS, and a vetted OAuth/OIDC provider.