Authentication, Authorization, Sessions and Security

Build secure authentication architecture, understand sessions and tokens, protect routes, enforce authorization, and avoid common security mistakes.

Authentication vs Authorization

Authentication determines who the user is. Authorization determines what that user is allowed to do.

For example, a user can successfully authenticate as alice@example.com but still be unauthorized to access another user's invoice.

A robust application checks authorization at the server boundary where the protected resource is accessed. Hiding a navigation link is not authorization.

Request Security Flow

Key Takeaways

Authentication identifies the principal.
Authorization controls permissions.
Authorization must be enforced server-side.

Session-Based Authentication

A session-based architecture commonly stores a session identifier in a secure cookie while the server maintains session state.

Cookies should normally use appropriate security attributes such as HttpOnly, Secure, and an intentional SameSite policy.

An HttpOnly cookie cannot be read by normal client-side JavaScript, reducing exposure to some token theft scenarios.

Key Takeaways

Session cookies can keep authentication state out of application JavaScript.
Use secure cookie attributes.
Authentication architecture must consider CSRF, XSS, session fixation, and logout behavior.

JWT-Based Authentication

A JSON Web Token can carry signed claims that allow a server to verify information without consulting session state for every request. However, JWTs are not automatically encrypted; signing and encryption solve different problems.

JWT-based systems require careful decisions around expiration, refresh tokens, revocation, audience, issuer, and key management.

For browser applications, storing sensitive long-lived tokens in JavaScript-accessible storage can increase the impact of XSS. Cookie-based approaches are often preferable depending on the architecture.

Key Takeaways

A signed JWT provides integrity, not necessarily confidentiality.
Short expiration and careful refresh-token design are important.
Token storage strategy is a major security decision.

Protecting Server Actions and Route Handlers

A protected page does not automatically protect every backend operation associated with it. A user might directly invoke a Route Handler or Server Action.

Every sensitive operation should establish the authenticated user and verify authorization for the target resource.

For example, deleteInvoice(invoiceId) must verify that the current user owns the invoice or has the appropriate role before deleting it.

Authorization Check

export async function deleteInvoice(invoiceId: string) {
  const user = await requireUser();
  const invoice = await getInvoice(invoiceId);

  if (!invoice || invoice.ownerId !== user.id) {
    throw new Error('Not authorized');
  }

  await removeInvoice(invoiceId);
}

💡 The operation verifies ownership at the mutation boundary rather than trusting the UI.

Key Takeaways

Protect mutations independently.
Check ownership or role permissions.
Never assume route-level protection covers every backend operation.

CSRF, XSS and Input Security

Cross-Site Request Forgery abuses a user's authenticated browser context to perform unwanted actions. Cross-Site Scripting attempts to execute attacker-controlled JavaScript in a user's browser.

React escapes normal text output, which provides an important baseline against XSS, but unsafe HTML rendering, third-party scripts, insecure DOM APIs, and poorly sanitized content can reintroduce risks.

Authentication architecture should consider CSRF protection, especially when authentication relies on cookies and cross-origin requests are involved.

Security Is Not One Feature

Authentication libraries do not eliminate application-level authorization, input validation, CSRF considerations, secret management, or secure coding practices.

Key Takeaways

Treat all external input as untrusted.
Avoid unsafe HTML injection unless content is properly sanitized.
Consider CSRF explicitly when using cookie-based authentication.

Authentication vs Authorization

Session-Based Authentication

JWT-Based Authentication

Protecting Server Actions and Route Handlers

CSRF, XSS and Input Security

STAY UPDATED WITH BYTES!