Skip to content

Authentication, identity & authorization

Passwords, MFA and passkeys, where browsers keep credentials, token rotation, OAuth with PKCE and OIDC, authorization models and tenant isolation.

6 lessons

Credentials and sessions

  1. 1Storing credentials, slow password hashing, MFA and passkeysA salt makes the attacker guess one account at a time; only a slow, memory-hard hash makes each guess expensive.
  2. 2Browser credential storage boundariesSeparate page lifetime, origin storage, and browser-attached session state before choosing a sign-out or credential-storage design.
  3. 3Access and refresh tokens: rotation and reuse detectionEvery refresh hands out a new refresh token; a used one coming back ends the whole sign-in.

Delegated identity

  1. 4OAuth 2.0 authorization code with PKCE, and what OIDC addsOnly a one-time code crosses the browser; the verifier redeems it, and each token is accepted only by the audience it names.

Authorization and tenancy

  1. 5Authorization models and enforcementA role can start the question; the protected object, relationship and context finish it.
  2. 6Multi-tenancy isolation and Postgres row-level securityRow security puts the tenant filter inside the database, for every role except the table's owner, superusers and bypassers.