Verify identity and control access.
Authentication verifies identity (passwords, MFA, biometrics, tokens, OAuth/OIDC, passkeys); authorisation decides permissions (RBAC, ABAC, ACLs). Store password hashes with bcrypt/Argon2, use short-lived tokens and least privilege. Session management and logout matter.
Logging in with Google uses OAuth 2.0 and OpenID Connect.
Authentication checks who a user is, and authorisation decides what they may do, so both are needed to protect any system.
Verify identity and control access.
Authentication checks who a user is, and authorisation decides what they may do, so both are needed to protect any system.
Authentication confirms identity, such as with a password or certificate. Authorisation decides which resources and actions that identity can use.
It requires a second proof, such as a code from a phone, so a stolen password alone is not enough to gain access.
Typical applications include logging in to a dashboard with a password and a second factor, giving operators read access but not configuration rights and checking a token before allowing an API call to delete a record.
Study "Cryptography basics" first (topic 85 of 104 in Software & Computing). It covers the groundwork this topic builds on.
JWT. SSO. Principle of least privilege.
Logging in with Google uses OAuth 2.0 and OpenID Connect.
The next topic is "Common vulnerabilities", which builds directly on this one.
It is classed as Advanced in Software & Computing (topic 86 of 104). It is an advanced topic. It assumes you are comfortable with the intermediate topics in Software & Computing.
Want to practise? Open the interactive course for quick checks, quizzes, simulations and progress tracking.