Authentication: establishing a verified identity

Understand the concept

Authentication verifies an identity claim using trustworthy evidence. Typing a name or email is not authentication. A request may present a cookie, bearer token, client certificate or another credential. A selected handler validates that evidence and, on success, creates a principal with claims. The scheme and source of those claims matter.

Authentication does not grant every permission. A valid employee identity still needs permission to read another employee’s salary. Evaluate the resource, operation, tenant and policy separately. CORS does not authenticate, HTTPS does not grant resource access, and decoding a JWT does not validate it.

Design the full lifecycle: initial login, failed attempts, expiry, renewal, logout and account closure. Passwords need appropriate hashing rather than plaintext storage. This course describes the security model rather than providing a complete login implementation. Subsequent lessons examine challenges, cookies, JWT validation and delegated access.