✅ *Authentication & Authorization Basics* 🔐🌐

This content originally appeared on DEV Community and was authored by ssekabira robert sims

What is Authentication?

It’s the process of verifying who a user is.

What is Authorization?

It’s the process of verifying what a user is allowed to do after logging in.

Step 1: Authentication – Common Methods

• Username & Password – Basic login

• OAuth – Login via Google, GitHub, etc.

• JWT (JSON Web Token) – Popular for token-based auth

• Session-Based – Stores session on server with session ID

Step 2: How Login Works (JWT Example)

1. User sends email & password to server
2. Server verifies and sends back a JWT
3. JWT is stored in browser (usually localStorage)
4. On each request, client sends JWT in headers
5. Server checks token before giving access

Step 3: Authorization Types

• Role-Based Access – Admin, Editor, User

• Resource-Based – Only owners can edit their content

• Route Protection – Block some pages unless logged in

Step 4: Protecting Routes (Frontend Example)

if (!localStorage.getItem('token')) {
  window.location.href = '/login';
}

Step 5: Backend Route Protection (Express.js)

function authMiddleware(req, res, next) {
  const token = req.headers.authorization;
if (!token) return res.status(401).send('Access Denied');
  // Verify token and decode user info
  next();
}

Step 6: Common Tools & Libraries

• bcrypt – Hash passwords

• jsonwebtoken (JWT) – Create & verify tokens

• passport.js – Auth middleware

• OAuth Providers – Google, Facebook, GitHub

Step 7: Best Practices

• Always hash passwords (never store plain text)

• Use HTTPS

• Set token expiry (e.g. 15 mins)

• Refresh tokens securely

• Don’t expose sensitive data in JWT

and like for more

This content originally appeared on DEV Community and was authored by ssekabira robert sims