Authentication
The process of verifying the identity of a user, device, or system. Answers the question "Who are you?" (contrasted with authorization, which answers "What can you do?").
Definition
Authentication (AuthN) confirms identity through something you know (password), something you have (security key), or something you are (biometrics). Modern authentication includes: password-based login, OAuth/OIDC (social login), magic links, passkeys, and multi-factor authentication (MFA). Authorization (AuthZ) is separate — it determines permissions after identity is confirmed. JWTs and session tokens are common ways to maintain authenticated state.
Why It Matters
Broken authentication is consistently in OWASP Top 10. Weak authentication leads to account takeover, data breaches, and compliance violations. Best practices include: strong password policies, MFA enforcement, secure session management, and protection against brute force attacks.
Example
A user enters their email and password (authentication). The system verifies credentials against the database. After successful authentication, the authorization layer checks if the user has permission to access the admin dashboard.