Web Authentication

Overview

• Focus on two common approaches: Session-Based Authentication and JWT (JSON Web Tokens).
• Explore the flow of each mechanism and their pros and cons.
• Goal: Understand when to use each approach.

Session-Based Authentication

1. Flow:

   • User sends login credentials to the server.
   • Server verifies credentials.
   • If valid, server creates a new session and stores session data (user ID, session expiration, metadata).
   • Server sends back a response with a unique session ID (cookie).
   • Client sends the session ID with each request for authentication.

2. Key Points:

   • Server creates and stores session data.
   • Session ID is used to retrieve session data on future requests.

3. Advantages:

   • Easy to revoke sessions (simply delete or invalidate the session on the server).
   • Sensitive data is stored on the server, enhancing security.

4. Challenges:

   • In a distributed system, all servers need access to the same session data, requiring a centralized session store (e.g., Redis).
   • Increased complexity and potential latency as the server must access the session store for each request.

JWT-Based Authentication

1. Flow:

   • User sends login credentials to the server.
   • Server verifies credentials.
   • If valid, server generates a JWT and signs it with a secret key, ensuring token integrity.
   • Server sends the JWT back to the client (response body).
   • Client stores the JWT (local storage or cookie).
   • Client sends the JWT in request headers on subsequent requests.
   • Server verifies the JWT signature for authentication.

2. Key Points:

   • Server does not store session state; all data is within the token itself, stored client-side.
   • Makes JWT stateless and easier to scale.

3. Signing Algorithms:

   • HMAC: Symmetric signing (same secret key for signing and verifying).
     • Simpler but requires sharing the secret key (security concern).
   • RSA and ECDSA: Asymmetric signing (private key for signing, public key for verification).
     • More secure but with added complexity and computational overhead.

4. Token Expiration:

   • Challenge with stolen tokens being usable until expiration.
   • Use refresh tokens with short-lived access tokens:
     • Access tokens (used for authentication) expire quickly (e.g., 15 minutes).
     • Refresh tokens (longer expiration) allow reissuing of access tokens without user re-login.

When to Use Each Approach

• Session-Based Authentication:

  • Good for instant revocation of sessions (e.g., compromised accounts).
  • Suitable if there's a centralized data store.
  • Keep sensitive data on the server for added security.

• JWTs:

  • Ideal for stateless architecture and easier horizontal scaling.
  • Useful for sharing authentication data across services (microservices architecture).
  • Consider implementing refresh tokens for better security and user experience.

Conclusion

• The choice between session-based authentication and JWTs depends on the specific needs and architecture of the application.
• Consider factors like scalability, security requirements, and user experience when making the decision.