Auth Patterns

Core Philosophy

1. Authentication is not authorization — Solve them separately. Authentication proves identity; authorization enforces what that identity may do.
2. Default deny — All resources are denied unless explicitly permitted. Never default allow.
3. Shortest lifetime possible — Access tokens: 5-15 minutes. Sessions: idle + absolute timeout. Backup codes: one use. Shorter lifetime = smaller breach window.
4. Validate every input, every time — JWT signature, expiry, issuer, audience, nonce. Skipping one check is the vulnerability.
5. Store nothing sensitive client-side — Tokens in HttpOnly cookies, secrets in secret managers, TOTP seeds encrypted at rest.

Quick-Start: Common Problems

"Which auth approach should I use?"