Authentication

First focus on "WHAT".

Authentication

Authentication is the act of proving an assertion, such as the identity of a computer system user. In contrast with identification, the act of indicating a person or thing's identity, authentication is the process of verifying that identity. It might involve validating personal identity documents, verifying the authenticity of a website with a digital certificate, determining the age of an artifact by carbon dating, or ensuring that a product or document is not counterfeit.

View on Wikipedia

OKAY.! But it is kinda hard for me. Let's understand with a simple example. For example, you're Sheldon Cooper you go to the bank to withdraw money. You say to the cashier give me $5000, they were like "Who are you?? I don't know you so I can't". This happens because they don't know you, to identify you as a real holder of your bank account. They provided you a bank account number and pin/signature to identify you. When you give these details to the cashier, he will like "Thank you! Mr. Cooper, here is your $5000". So this shows that by giving the details it identifies you as the real holder of the bank account. So the process or action of verifying the identity of a user or process is Authentication.

Types of Authentication

1. Stateful
   • Cookie/Session Based Auth.
2. Stateless
   • Basic Auth
   • JWT
   • OAuth

Stateful Authentication

Stateful Authentication is a way to verify users by having the server or backend store much of the session information, such as user properties.
In this method whenever a client requests to the server, the request carries the unique-id provided by the server at the authentication time and this ID is matched against its identity provider (IdP).
Stateful authentication is also called session-based authentication or cookie-based authentication for the session information the server must store on the user.

Advantages

• Revoke the session anytime.
• Easy to implement and manage.

Disadvantages

• Increasing server overhead: As the number of logged-in users increases, the more server resources are occupied.
• Server has to store the session id which limits scalability.

Stateless Authentication

Stateless authentication is a way to verify a user by storing its data on the client-side and signing it with some cryptographic signature. This signed data is known as a token. Whenever a client tries to request the server, the server verifies the signed token, check if the token is valid or not.

Advantages

• Easy to scale
• Lower server overhead: Server does not have to allocate resources to the client.

Disadvantages

• Cannot revoke the session anytime: As token is stored at client side, server does not have any rights to delete the session.
• Relatively complex to implement: It increases the technical complexity while implementing.
• If a token gets steal before expiring and a hacker uses it, the server has no way to identify it. That's why token's expiry time should be less(<=15min).

Conclusion

Both approaches make sense, both have their advantages and disadvantages. Stateless authentication easier to implement and scale, but stateful authentication is more secure and easier to manage. In the next part, we'll understand each way of authentication like JWT, Cookie, OAuth, Etc.

Bibliography

• Stateful vs Stateless Authentication
• Difference between cookies, session and tokens