Questions tagged [authentication]

Authentication is the process of providing a proof of identity or verifying identity.

Authentication is the process of providing a proof of identity or verifying identity. This might involve confirming the identity of a person or software program, tracing the origins of an artifact, or ensuring that a product is what its packaging and labeling claims to be. Authentication is different than Authorization, which is the step of allowing access to a resource. Authentication and authorization usually happen together to verify identity and then allow access.

The first type of authentication is accepting proof of identity given by a credible person who has evidence on the said identity, or on the originator and the object under assessment as the originator's artifact respectively.

The second type of authentication is comparing the attributes of the object itself to what is known about objects of that origin. For example, an art expert might look for similarities in the style of painting, check the location and form of a signature, or compare the object to an old photograph.

The third type of authentication relies on documentation or other external affirmations.

Factors and identity

The ways in which someone may be authenticated fall into three categories, based on what is known as the factors of authentication: something the user knows, something the user has, and something the user is. Each authentication factor covers a range of elements used to authenticate or verify a person's identity prior to being granted access, approving a transaction request, signing a document or other work product, granting authority to others, and establishing a chain of authority.

74922 questions
295
votes
7 answers

Authentication: JWT usage vs session

What is the advantage of using JWTs over sessions in situations like authentication? Is it used as a standalone approach or is it used in the session?
Pourya8366
  • 3,424
  • 4
  • 21
  • 28
295
votes
5 answers

JWT refresh token flow

I'm building a mobile app and am using JWT for authentication. It seems like the best way to do this is to pair the JWT access token with a refresh token so that I can expire the access token as frequently as I want. What does a refresh token look…
jtmarmon
  • 5,727
  • 7
  • 28
  • 45
290
votes
7 answers

What if JWT is stolen?

I am trying to implement stateless authentication with JWT for my RESTful APIs. AFAIK, JWT is basically an encrypted string passed as HTTP headers during a REST call. But what if there's an eavesdropper who see the request and steals the token? …
smwikipedia
  • 61,609
  • 92
  • 309
  • 482
287
votes
11 answers

Removing the remembered login and password list in SQL Server Management Studio

I've recently used our company's spare laptop (that has a general user set up) while mine was being repaired. I've checked the "Remember password" option in SQL Server Management Studio when logging in to the database. I need to clear the login and…
Elanie Meyer
285
votes
15 answers

user authentication libraries for node.js?

Are there any existing user authentication libraries for node.js? In particular I'm looking for something that can do password authentication for a user (using a custom backend auth DB), and associate that user with a session. Before I wrote an auth…
shreddd
  • 10,975
  • 9
  • 33
  • 34
278
votes
11 answers

Add Keypair to existing EC2 instance

I was given AWS Console access to an account with 2 instances running that I cannot shut down (in production). I would, however, like to gain SSH access to these instances, is it possible to create a new Keypair and apply it to the instances so I…
Chris Wagner
  • 20,773
  • 8
  • 74
  • 95
273
votes
7 answers

Why does AuthorizeAttribute redirect to the login page for authentication and authorization failures?

In ASP.NET MVC, you can mark up a controller method with AuthorizeAttribute, like this: [Authorize(Roles = "CanDeleteTags")] public void Delete(string tagName) { // ... } This means that, if the currently logged-in user is not in the…
Roger Lipscombe
  • 89,048
  • 55
  • 235
  • 380
268
votes
13 answers

In Subversion can I be a user other than my login name?

I'd like to know how to get Subversion to change the name that my changes appear under. I'm just starting to use Subversion. I'm currently using it to version control code on an XP laptop where I'm always logged in under my wife's name. I'd like the…
markets
  • 9,344
  • 7
  • 34
  • 33
264
votes
11 answers

What is the purpose of a "Refresh Token"?

I have a program that integrates with the YouTube Live Streaming API. It runs on timers, so its been relatively easy for me to program in to fetch a new Access Token every 50 minutes with a Refresh Token. My question is, why? When I authenticated…
257
votes
10 answers

What is an Endpoint?

I have been reading about OAuth and it keeps talking about endpoints. What is exactly an endpoint?
Klanestro
  • 3,185
  • 5
  • 25
  • 31
255
votes
4 answers

What is the difference between Digest and Basic Authentication?

What is the difference between Digest and Basic Authentication ?
255
votes
15 answers

Set cookies for cross origin requests

How to share cookies cross origin? More specifically, how to use the Set-Cookie header in combination with the header Access-Control-Allow-Origin? Here's an explanation of my situation: I am attempting to set a cookie for an API that is running on…
Pim van der Heijden
  • 6,956
  • 4
  • 16
  • 21
254
votes
28 answers

Configuration System Failed to Initialize

I'm currently creating a Login form and have this code: string connectionString = ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString; try { using (OdbcConnection connect = new OdbcConnection(connectionString)) { …
sean
  • 9,198
  • 22
  • 65
  • 80
240
votes
10 answers

Token Authentication vs. Cookies

What is the difference between token authentication and authentication using cookies? I am trying to implement the Ember Auth Rails Demo but I do not understand the reasons behind using token authentication as described in the Ember Auth FAQ on the…
John
  • 13,125
  • 14
  • 52
  • 73
236
votes
2 answers

How to create user for a db in postgresql?

I have installed PostgreSQL 8.4 on my CentOS server and connected to root user from shell and accessing the PostgreSQL shell. I created the database and user in PostgreSQL. While trying to connect from my PHP script it shows me authentication…
user925355