Authentication proves identity—"who are you?"—before authorization decides what you can do.
Factors
- Something you know — password, PIN
- Something you have — phone, hardware key
- Something you are — biometric (use carefully with privacy)
Password storage
Apps must never store plaintext passwords. Use slow password hashes (bcrypt, Argon2) with unique salt per user—see hashing lesson.
Session after login
After auth, issue a session cookie or token; validate on every request—do not re-prompt password per click.
Important interview questions and answers
- Q: Auth vs authz?
A: Authentication = identity; authorization = permissions. - Q: Plaintext passwords?
A: Never—use salted slow hashes.
Self-check
- Name three authentication factors.
- Why not store passwords in plaintext?
Pitfall: Rolling custom crypto for passwords—use battle-tested libraries.
Interview prep
- Auth vs authz?
Identity vs permission.