Introduction

Authentication is one of the most important concepts in secure programming.

Authentication means verifying the identity of a user, device, application, or system before allowing access.

For example, when a user enters an email and password to log in, the application checks whether the provided information matches a valid account. If the information is correct, the user is authenticated.

Authentication is the first step in protecting user accounts, private data, admin features, financial records, student records, and business systems.

Easy Real-Life Example

Office Security:
Show ID card
Security checks identity
If valid, entry is allowed

Software Authentication:
Enter username and password
System checks credentials
If valid, login is allowed

Authentication is like identity verification at the entrance of a secure place.

What is Authentication?

Authentication is the process of confirming that someone or something is truly who it claims to be.

In software applications, authentication commonly happens through credentials such as:

Why Authentication is Important

Without authentication, anyone could access private features or sensitive information.

Authentication protects applications by making sure that only verified users can enter the system.

What Can Go Wrong Without Authentication?

If an application does not authenticate users properly, attackers or unauthorized users may access features that should be protected.

Authentication vs Authorization

Authentication and authorization are related, but they are not the same.

Basic Authentication Flow

A typical login-based authentication flow follows these steps:

1. User enters login details.
2. Application receives the credentials.
3. Application validates the input.
4. Application checks credentials against stored account data.
5. If credentials are valid, authentication succeeds.
6. Application creates a session or token.
7. User can access authenticated features.

In secure applications, this flow should also include protections such as safe password handling, secure error messages, login attempt controls, and session management.

User Identity

A user identity represents a user inside a system.

It may include account details such as username, email, user ID, role, profile information, and login status.

Example User Identity:
userId: 1025
email: student@example.com
role: Student
status: Active

Authentication verifies that the person trying to use this identity is allowed to do so.

Password-Based Authentication

Password-based authentication is one of the most common authentication methods.

The user enters a username or email along with a password. The system verifies whether the password is correct for that account.

Unsafe Password Handling

Store password directly as plain text.

Problem:
If the database is exposed, all passwords are exposed.

Safer Password Handling

Store password using a secure password hashing approach.

During login:
- User enters password.
- System hashes the entered password.
- System compares it with the stored password hash.

Passwords should not be stored as plain text.

Password Strength

A weak password can be guessed more easily. Applications should encourage or enforce strong password practices.

Multi-Factor Authentication

Multi-Factor Authentication, or MFA, adds extra verification beyond only a password.

MFA requires users to provide more than one type of proof.

Example MFA Login:
1. User enters password.
2. System sends or requests OTP.
3. User enters OTP.
4. If both password and OTP are valid, login succeeds.

MFA improves security because a stolen password alone may not be enough to access the account.

OTP Authentication

OTP means One-Time Password.

An OTP is a temporary code used for verification. It is usually valid for a short period or for a single use.

OTP Flow:
1. User enters username and password.
2. System asks for OTP.
3. User receives or generates OTP.
4. User enters OTP.
5. System verifies OTP.
6. Login continues if OTP is valid.

OTPs are commonly used as part of MFA.

Token-Based Authentication

In token-based authentication, the system issues a token after successful login.

The client sends this token with future requests so the server can identify the authenticated user.

Token-Based Flow:
1. User logs in successfully.
2. Server creates an authentication token.
3. Client stores token safely.
4. Client sends token with future requests.
5. Server validates token before processing request.

Tokens should be protected because anyone who obtains a valid token may attempt to use it.

Session-Based Authentication

In session-based authentication, the server creates a session after successful login.

The user receives a session identifier, often stored in a secure cookie. The server uses this session identifier to remember the authenticated user.

Session-Based Flow:
1. User logs in.
2. Server creates a session.
3. Server sends session identifier to browser.
4. Browser sends session identifier with future requests.
5. Server checks session and identifies user.

Sessions should be unique, hard to guess, protected, and expired when no longer needed.

Session Expiry and Logout

Authentication should not last forever. Sessions and tokens should expire based on security needs.

Secure Authentication Error Messages

Authentication error messages should be safe and should not reveal too much information.

Unsafe Error Message

Email exists, but password is wrong.

This reveals that the email is registered.

Safer Error Message

Invalid username or password.

This message is safer because it does not reveal which part was wrong.

Login Attempt Protection

Applications should protect login systems from repeated guessing attempts.

Sensitive Accounts

Sensitive accounts include administrator accounts, service accounts, database accounts, and internal system accounts.

These accounts should be protected more carefully because misuse can cause serious damage.

Single Sign-On

Single Sign-On, or SSO, allows users to authenticate through a trusted identity provider and access multiple applications.

SSO Example:
User signs in through trusted identity provider.
Application trusts the identity provider response.
User accesses application without creating a separate password.

SSO can simplify login management and centralize identity control when implemented correctly.

Authentication and User Registration

Registration is often the first step before authentication.

A secure registration process should collect required information, validate input, verify email or phone where needed, and avoid creating duplicate or fake accounts.

Registration Checks:
- Validate email format.
- Confirm password rules.
- Verify email ownership if required.
- Avoid duplicate accounts.
- Store password securely.

Password Reset

Password reset is a sensitive feature because attackers may try to misuse it to take over accounts.

Real-World Example: E-Commerce Login

In an e-commerce application, authentication protects customer accounts, orders, addresses, payment preferences, and purchase history.

Student-Friendly Example: Student Portal Login

Student Portal Authentication:

1. Student enters email and password.
2. System validates required fields.
3. System checks whether credentials are valid.
4. If valid, system creates a session.
5. Student can view own marks and attendance.
6. Student cannot access admin-only features.

Authentication confirms the student identity. Authorization decides what the student can access after login.

Example: Basic Login Logic

Weak Version

INPUT email
INPUT password

IF email == storedEmail AND password == storedPassword THEN
    DISPLAY "Login successful"
ELSE
    DISPLAY "Login failed"
END IF

This example is simple, but it directly compares plain passwords and does not show secure password storage.

Better Conceptual Version

INPUT email
INPUT password

IF email is empty OR password is empty THEN
    DISPLAY "Invalid username or password"
    STOP
END IF

userAccount = FIND account by email

IF userAccount does not exist THEN
    DISPLAY "Invalid username or password"
    STOP
END IF

IF password does not match stored password hash THEN
    DISPLAY "Invalid username or password"
    STOP
END IF

CREATE secure session

DISPLAY "Login successful"

This version uses safer error messages and avoids revealing whether the email exists.

Example: Authentication with MFA

INPUT email
INPUT password

IF credentials are invalid THEN
    DISPLAY "Invalid username or password"
    STOP
END IF

SEND or REQUEST second factor code

INPUT verificationCode

IF verificationCode is invalid THEN
    DISPLAY "Authentication failed"
    STOP
END IF

CREATE secure session

DISPLAY "Login successful"

This shows the idea of using a second factor after the password is verified.

Authentication Checklist

Common Beginner Mistakes

Best Practices for Authentication

Prerequisites Before Learning Authentication

Students should understand the following topics before learning authentication deeply:

Trace Table Example: Login Validation

FUNCTION authenticateUser(email, password)
    IF email is empty OR password is empty THEN
        RETURN "Invalid username or password"
    END IF

    userAccount = FIND account by email

    IF userAccount does not exist THEN
        RETURN "Invalid username or password"
    END IF

    IF password does not match stored password hash THEN
        RETURN "Invalid username or password"
    END IF

    RETURN "Authenticated"
END FUNCTION

Practice Activity: Improve Login Security

Improve the following pseudocode by applying authentication best practices.

INPUT username
INPUT password

IF username == "admin" AND password == "admin123" THEN
    DISPLAY "Welcome admin"
ELSE
    DISPLAY "Wrong password"
END IF

Sample Improved Concept

INPUT username
INPUT password

IF username is empty OR password is empty THEN
    DISPLAY "Invalid username or password"
    STOP
END IF

userAccount = FIND account by username

IF userAccount does not exist THEN
    DISPLAY "Invalid username or password"
    STOP
END IF

IF password does not match stored password hash THEN
    DISPLAY "Invalid username or password"
    STOP
END IF

CREATE secure session

DISPLAY "Login successful"

The improved concept avoids hardcoded credentials, validates input, uses a generic error message, and creates a secure session after successful authentication.

Practice Test Cases

Mini Quiz

Interview Questions on Authentication Basics

Quick Summary