#Auth on the backend

1 messages · Page 1 of 1 (latest)

versed crane
#

Can anyone help me by providing some resources about auth on the backend, like the different types, session, jwt and how they are implemeted (not like programming language or framework specific) but like having a hard time figuring it out.

sick tinselBOT
#

<@&987246964494204979> please have a look, thanks.

#

Here is an AI assisted attempt to answer your question 🤖. Maybe it helps! In any case, a human is on the way 👍. To continue talking to the AI, you can use </chatgpt:1108714622413963314>.

#
TJ-Bot
Can anyone help me by providing some resources about auth on the backend, like the different types, session, jwt and how they are implemeted (not like programming language or framework specific) but like having a hard time figuring it out.

work specific, just the concepts and best practices)? I am trying to understand the basics of authentication on the backend and how it is implemented in different scenarios.

Answer:

  • Authentication on the backend is a crucial part of web development to ensure secure access to resources.
  • There are different types of authentication mechanisms, such as session-based and token-based authentication.
  • Session-based authentication involves storing user session information on the server, typically using cookies. This method is commonly used in traditional web applications.
  • Token-based authentication, such as JWT (JSON Web Tokens), involves generating a unique token for each user upon successful login. This token is then sent with each subsequent request to authenticate the user.
  • JWTs are stateless and can be easily shared between different services, making them popular for modern API authentication.
  • When implementing authentication on the backend, it's important to follow best practices such as securely storing passwords (using hashing algorithms like bcrypt), implementing rate limiting and monitoring for suspicious activity, and keeping sensitive information encrypted.
  • Additionally, consider using HTTPS to encrypt data in transit and always validate user input to prevent security vulnerabilities like SQL injection attacks.
- AI generated response
versed crane
#

I'm building a monolithic app so don't need JWTs

sick tinselBOT
#
TJ-Bot
Tell me more about session based authentication and what that looks like for both the backend and frontend

Session-based authentication is a common method used to authenticate users in web applications. It involves creating a unique session for each user who logs in, and storing that session information on both the backend and frontend.

On the backend, when a user logs in, a session is created and stored in a session store (such as a database or memory cache) with a unique identifier. This identifier is then sent to the frontend as a cookie or in the response header. The backend can then use this identifier to retrieve the session data when the user makes subsequent requests.

For the frontend, when a user logs in, the session identifier is stored locally (usually in a cookie) so that it can be sent back with each request to authenticate the user. This allows the backend to identify and validate the user without requiring them to log in again for every request.

In terms of implementation, developers must ensure that sessions are securely stored and managed on both ends to prevent unauthorized access. This includes using secure cookies, encrypting session data, and implementing measures such as CSRF tokens to prevent cross-site request forgery attacks.

Overall, session-based authentication provides a convenient and secure way to authenticate users in web applications by creating and managing unique sessions for each user on both the backend and frontend.

- AI generated response
crude matrix
#

you can start with the basic with Java EE (now Jakarta EE) to understand session etc then move on to Spring where they have the guides and sample code.

versed crane
#

just want to learn about the general auth stuff

crude matrix
#

there is a site i can't remember the name - it actually has all the details and spec inside you can google OAuth2 and OIDC flow sorry i tried to google to recall it is not showing up but it is a very detailed guide where they show you everything in diagram etc

#

think this is the site