Lesson 210
Authentication & Authorization
authN vs authZ · passwords · tokens · OAuth · access control
1:00How identity verification (authN) and permission enforcement (authZ) work — from password hashing and MFA to JWTs, OAuth 2.0, and role-based access control.
By the end, you can
- Explain the difference between authentication and authorization and give an example where being logged in does not grant a specific action.
- Describe the three MFA factor categories and explain why passkeys resist phishing.
- Outline the correct way to store a password (unique salt, slow hash) and explain what the salt prevents and what the slowness prevents.
- Compare stateful sessions and stateless JWTs on revocability and scalability.
- State what a JWT signature proves (integrity, not secrecy) and what must never appear in the payload.
- Trace the four steps of the OAuth 2.0 Authorization Code flow and identify the role of each actor.
- Distinguish an access token (for API authorization) from an ID token (for app-side authentication).
- Describe ACL, RBAC, and ABAC and apply the principle of least privilege.
Up next in Information Theory, Cryptography & Security
