What Is Authentication? AuthN vs AuthZ, Sessions, and JWTs
Authentication (AuthN) is the security process of verifying that an entity (user, server, or application) is genuinely who or what it claims to be.
💡 Plain-English Analogy
Authentication is showing your passport at border control to prove who you are (AuthN). Authorization is your boarding pass determining which seat and boarding group you are allowed to access (AuthZ).
⚙️ Architecture & Under the Hood
Modern web authentication spans traditional stateful server sessions (session IDs stored in Redis and returned via HttpOnly cookies) and stateless token architectures (JSON Web Tokens / JWTs signed via HMAC-SHA256 or RSA-256). Delegated identity is standardized via OAuth 2.0 and OpenID Connect (OIDC).
Authentication (AuthN) vs Authorization (AuthZ)
Security systems clearly separate identity verification from permission management.
- Authentication (AuthN): "Who are you?" (e.g. email + password verification, biometrics).
- Authorization (AuthZ): "What are you permitted to do?" (e.g. role-based access control checking if user is an admin).
Frequently Asked Questions
Can anyone read the payload of a JSON Web Token (JWT)?
Yes! Standard JWT payloads are merely Base64Url encoded, NOT encrypted. Never store private secrets or passwords in a JWT payload; the cryptographic signature only guarantees the payload has not been tampered with.