Authentication Fundamentals

# CHAPTER 4

Authentication Fundamentals #

1. Introduction #

2. Learning Objectives #

• Clearly define the difference between Authentication (AuthN) and Authorization (AuthZ).

• Understand how traditional Session-Based Authentication works.

• Understand the paradigm shift to Stateless Token-Based Authentication.

• Recognize the benefits of tokens (like JWTs) in modern REST APIs.

• Identify common authentication attack vectors.

3. Beginner-Friendly Explanation #

Imagine going to an airport.

• Authentication: You show your Passport to the TSA agent. They verify your face matches the photo. They now know exactly *who* you are.

• Authorization: You walk up to the First Class lounge. The lounge attendant looks at your boarding pass. Because you bought an Economy ticket, you are denied entry. You are authenticated (they know who you are), but you are *not authorized* to enter the lounge.

APIs work exactly the same way. The /api/login endpoint handles Authentication. Every subsequent API request handles Authorization.

4. Real-World Attack Scenarios #

• Credential Stuffing: Hackers buy millions of leaked username/password combos from a dark web breach (like a Yahoo hack) and use automated bots to test them against your API's /login endpoint. Because people reuse passwords, thousands of logins succeed.

• Session Hijacking: An attacker steals a user's unencrypted session cookie. They paste that cookie into their own browser or Postman request. The API thinks the attacker is the legitimate user.

5. Evolution: Stateful vs Stateless Auth #

2. Token-Based Auth (Stateless - The Modern API Way) When you log in, the server mathematically generates a signed Token (e.g., a JWT) and gives it to you. The server does *not* save anything in its memory. When you send a request, you attach the Token. The server uses cryptography to verify the signature on the Token. Because the server doesn't rely on memory, it scales infinitely.

6. Vulnerable vs Secure Code Examples #

<?php
// A hacker can hit this endpoint 10,000 times a second trying to guess passwords
$email = $_POST[&#039;email'];
$password = $_POST[&#039;password'];

$user = $db->query("SELECT * FROM users WHERE email = &#039;$email'");
if (password_verify($password, $user[&#039;password'])) {
    echo "Logged in!";
}
?>

Secure (Rate Limited & Time Safe):

<?php
// Implement Rate Limiting (e.g., max 5 attempts per minute)
if (check_rate_limit($_SERVER[&#039;REMOTE_ADDR']) > 5) {
    http_response_code(429);
    die("Too many login attempts. Try again later.");
}

$email = filter_var($_POST[&#039;email'], FILTER_SANITIZE_EMAIL);
$password = $_POST[&#039;password'];

// Use prepared statements
$stmt = $db->prepare("SELECT password_hash FROM users WHERE email = ?");
$stmt->execute([$email]);
$user = $stmt->fetch();

if ($user && password_verify($password, $user[&#039;password_hash'])) {
    echo json_encode(["token" => generate_secure_token()]);
} else {
    // Return generic error. Never reveal if the email exists or not!
    http_response_code(401);
    echo json_encode(["error" => "Invalid credentials."]);
}
?>

7. HTTP Examples (Token Auth) #

GET /api/v1/bank-accounts HTTP/1.1
Host: api.bank.com
Authorization: Bearer abcdef1234567890secrettoken

8. JSON Examples #

{
  "status": "success",
  "data": {
    "user_id": 105,
    "access_token": "eyJhbGciOiJIUzI...",
    "token_type": "Bearer",
    "expires_in": 3600
  }
}

9. Best Practices #

• Use bcrypt/Argon2: Never store passwords in plain text or use MD5/SHA1. Always use PHP's built-in passwordhash() and passwordverify() functions.

• Generic Error Messages: If a login fails, say "Invalid email or password." Do NOT say "User not found" or "Incorrect password." If you do, hackers can use your API to harvest a list of valid emails.

• Stateless REST: REST APIs should ideally be stateless. Transition away from PHP $SESSION arrays and move toward JSON Web Tokens (JWTs).

13. MCQs with Answers #

14. Interview Questions #

• Q: Explain the difference between Authentication and Authorization using a real-world analogy.

• Q: What is the difference between Stateful and Stateless authentication? Why do REST APIs prefer Stateless?

• Q: Explain "Credential Stuffing" and how you would protect your API's login endpoint against it.

15. FAQs #

16. Summary #

17. Next Chapter Recommendation #