System Security & Authentication

Security is a foundational pillar of software system design. Robust distributed architectures implement security in depth across authentication, authorization, transport encryption, and data protection.

---

1. Authentication vs Authorization

Concept	Core Question	Real-World Analog	Implementation
Authentication (AuthN)	Who are you?	Showing your Passport at airport customs	Passwords, Biometrics, SSO, OTP, SAML
Authorization (AuthZ)	What permissions do you have?	Your Boarding Pass allowing access to Flight 402	RBAC (Role-Based Access Control), ABAC, OAuth Scopes

---

2. OAuth 2.0 Authorization Code Flow

OAuth 2.0 is the industry standard protocol for delegated authorization, enabling third-party apps to access user resources without ever receiving raw user credentials.

User (Browser)               Client App (Frontend/Backend)         OAuth Auth Server (Google)
      │                                    │                                    │
      │─── 1. Click "Login with Google" ──>│                                    │
      │                                    │─── 2. Redirect to Auth URL ───────>│
      │<── 3. Present Login & Consent ─────┼────────────────────────────────────│
      │─── 4. User Approves Permissions ───┼───────────────────────────────────>│
      │                                    │<── 5. Redirect with Auth Code ─────│
      │                                    │                                    │
      │                                    │─── 6. Exchange Code + Secret ─────>│ (Server-to-Server)
      │                                    │<── 7. Returns Access + ID Token ───│

---

3. JWT (JSON Web Tokens) vs Server Sessions

Header (Base64)   : {"alg": "HS256", "typ": "JWT"}
Payload (Base64)  : {"sub": "usr_99", "role": "admin", "exp": 1772300000}
Signature (HMAC)  : HMACSHA256(Base64(Header) + "." + Base64(Payload), SECRET)

Trait	Stateless JWT	Stateful Session Store
Storage Location	Client (HTTP-only Secure Cookie or memory)	Server (Redis cluster / Session DB)
Server Memory Cost	Zero (validated cryptographically via secret/public key)	Proportional to number of active logged-in users
Immediate Revocation	Difficult (must maintain revocation blocklist until expiration)	Trivial (delete session key from Redis)
Data Size	Larger (hundreds of bytes payload per HTTP request)	Tiny (32-character session ID string)

---

4. HTTPS & TLS 1.3 Handshake

TLS (Transport Layer Security) encrypts communication over TCP, providing Confidentiality, Integrity, and Server Authentication.

Client                                                  Server
  │                                                        │
  │──── Client Hello (Supported Ciphers + Key Share) ─────>│
  │                                                        │
  │<─── Server Hello (Chosen Cipher + Server Key Share) ───│
  │<─── Encrypted Server Certificate & Signature ──────────│
  │<─── Server Finished ───────────────────────────────────│
  │                                                        │
  │──── Client Finished ──────────────────────────────────>│
  │                                                        │
  │═════════════ 1-RTT Secure Encrypted Channel ═══════════│

---

5. Security Threat Mitigation Checklist

Security Threat	Attack Vector	Engineering Defense
SQL Injection (SQLi)	Malicious SQL syntax injected into queries	Parameterized queries, ORM prepared statements
Cross-Site Scripting (XSS)	Injected malicious JS executed in client browser	Input sanitization, output encoding, strict CSP headers
Cross-Site Request Forgery (CSRF)	Unauthorized commands transmitted from trusted user	SameSite cookies (SameSite=Strict), anti-CSRF tokens
DDoS Attacks	Volumetric traffic saturation	Anycast CDN, WAF, IP Rate Limiting
Credential Stuffing	Automated brute force using breached passwords	bcrypt / Argon2 hashing, CAPTCHA, MFA