Authentication
You might say
How do I verify that someone is who they say they are? I need to add sign-in.
Verify who is making the requestAuthentication proves an identity through a password, passkey, one-time code, or trusted provider and then maintains a session. Store credentials safely, limit repeated attempts, and protect recovery paths. After identity is known, Authorization still decides what that person may do.
Know first
AuthJWT
You can say this to an AI Agent
The orders page currently trusts a userId sent by the browser. Change it to obtain the current user from verified sign-in state before querying orders. Test signed-in and signed-out access: the first must show only that user’s orders, and the second must require sign-in.
When to use it
- Sign a user inA mature solution provides common authentication capabilities.Password / verification code→Identity service→Secure session
- Maintain a secure sessionCommon protections for login cookiesHttpOnlyScripts cannot read itSecureHTTPS onlySameSiteLimit cross-site sending
- Verify a sensitive action againFailure messages do not reveal account statusNot recommendedThat email does not exist → RecommendedIncorrect account or password
- Recover account access through a controlled processSigning out must actually invalidate credentials.Session valid→Server revokes it→Request again: 401
When NOT to use it
- Store plain-text passwordsPasswords cannot be stored in plain text.email: dev@ans.orgpassword: 123456If the database leaks, plaintext passwords are exposed immediately.
- Treat a user ID sent by the browser as proof of identityJWT contents can usually be decoded and viewed.header.payload.signaturepayload: { "email": "dev@ans.org" }Do not put sensitive information such as passwords or tokens in it.
- Use long-lived tokens with no revocation planChanging a local variable does not prove identity.Console changeisLoggedIn = true → Server checkNo valid session · 401
- Reveal whether a private account exists through detailed errorsLogin endpoint without rate limiting1 minute10,000 attemptsResultPassword guessing can continue
Anatomy
Identity credentials→Server verification→Login status
Password, one-time verification code or identity result returned by third-party platform
The server checks the credentials, speed limit and handles the failure. It does not believe that the front end announces that the login is successful.
Use secure cookies or protected tokens to allow subsequent requests to prove it is the same user
Variants
Cookie Session
Set-Cookie: session=…Common for web apps; browsers send the cookie automatically.
Bearer Token
Authorization: Bearer …Common for mobile apps and standalone APIs.
OAuth Login
Continue with GitHub
Delegate identity proof to a trusted provider.
Typical use cases
Sign in
Email passwordEstablish login status after successful verification
Login
Session✓ Established
Passkey
One-time verification codeThe verification code is only valid for a short period of time
Remaining time04:32Number of attempts1 / 5
VerificationOne-time code
Third-party loginLeave identity verification to a mature platform
Continue using GitHubContinue using Google
The platform returns the identity result, and this site then creates its own session
Account recovery
Exit and expirationRe-authentication is required after the session expires
Click to exit→Server-side revoke Session→Protected request → 401
Recommended tool
Web fine-tuning tool · Selector Pro
Select page elements for precise AI edits
Click a button, text, or card, note the change, then copy its exact location to AI.
Open Selector Pro website↗Further reading
Quick check