Questions tagged [authentication]

Authentication is the process of providing a proof of identity or verifying identity.

Authentication is the process of providing a proof of identity or verifying identity. This might involve confirming the identity of a person or software program, tracing the origins of an artifact, or ensuring that a product is what its packaging and labeling claims to be. Authentication is different than Authorization, which is the step of allowing access to a resource. Authentication and authorization usually happen together to verify identity and then allow access.

The first type of authentication is accepting proof of identity given by a credible person who has evidence on the said identity, or on the originator and the object under assessment as the originator's artifact respectively.

The second type of authentication is comparing the attributes of the object itself to what is known about objects of that origin. For example, an art expert might look for similarities in the style of painting, check the location and form of a signature, or compare the object to an old photograph.

The third type of authentication relies on documentation or other external affirmations.

Factors and identity

The ways in which someone may be authenticated fall into three categories, based on what is known as the factors of authentication: something the user knows, something the user has, and something the user is. Each authentication factor covers a range of elements used to authenticate or verify a person's identity prior to being granted access, approving a transaction request, signing a document or other work product, granting authority to others, and establishing a chain of authority.

74922 questions
185
votes
9 answers

Android: Storing username and password?

If I want to store the username and password to be used inside an Android application, what is the best way to do it? Is it through the preferences screen (but what if the user misses this?), or pop up a dialog box and ask the user for the…
Legend
  • 113,822
  • 119
  • 272
  • 400
176
votes
11 answers

HttpWebRequest using Basic authentication

I'm trying to go through an authentication request that mimics the "basic auth request" we're used to seeing when setting up IIS for this behavior. The URL is:…
Kenny Rullo
  • 2,467
  • 2
  • 16
  • 7
175
votes
5 answers

Microservice Authentication strategy

I'm having a hard time choosing a decent/secure authentication strategy for a microservice architecture. The only SO post I found on the topic is this one: Single Sign-On in Microservice Architecture My idea here is to have in each service (eg.…
Augustin Riedinger
  • 20,909
  • 29
  • 133
  • 206
174
votes
21 answers

How can I get browser to prompt to save password?

Hey, I'm working on a web app that has a login dialog that works like this: User clicks "login" Login form HTML is loaded with AJAX and displayed in DIV on page User enters user/pass in fields and clicks submit. It's NOT a
-- user/pass are…
Eric
  • 5,104
  • 10
  • 41
  • 70
174
votes
10 answers

Best way for a 'forgot password' implementation?

I'm looking for the best method to implement a "forgot password" feature. I come out with 2 ideas: When user click on forgot password, the user is required to key in the username, email and maybe date of birth or last name. Then a mail with…
Hoe Chin
172
votes
4 answers

Token Based Authentication in ASP.NET Core

I'm working with ASP.NET Core application. I'm trying to implement Token Based Authentication but can not figure out how to use new Security System for my case. I went through examples but they didn't help me much, they are using either cookie…
Grant
  • 2,295
  • 3
  • 14
  • 13
171
votes
23 answers

Cannot login to Docker account

OS: Ubuntu 18.04 Server Docker 18.3 CE I am logged onto the server, from my Windows 10 laptop, using a PuTTY SSH session. I don't have Docker on my local Windows laptop, so all the work is done on the remote server. I can execute all Docker…
EastsideDev
  • 6,257
  • 9
  • 59
  • 116
164
votes
3 answers

Single sign-on flow using JWT for cross domain authentication

There is a lot of information on the web about using JWT (Json Web Token) for authentication. But I still didn't find a clear explanation of what the flow should be when using JWT tokens for a single sign-on solution in a multiple domains…
electrotype
  • 8,342
  • 11
  • 59
  • 96
164
votes
18 answers

Login credentials not working with Gmail SMTP

I am attempting to send an email in Python, through Gmail. Here is my code: import smtplib fromaddr = '......................' toaddrs = '......................' msg = 'Spam email Test' username = '.......' password =…
Jacob Kudria
  • 2,200
  • 3
  • 17
  • 18
161
votes
4 answers

What does passport.session() middleware do?

I am building an authentication system using Passport.js using Easy Node Authentication: Setup and Local tutorial. I am confused about what passport.session() does. After playing around with the different middleware I came to understand that…
Georges Krinker
  • 2,259
  • 4
  • 25
  • 24
160
votes
4 answers

Performing user authentication in Java EE / JSF using j_security_check

I'm wondering what the current approach is regarding user authentication for a web application making use of JSF 2.0 (and if any components do exist) and Java EE 6 core mechanisms (login/check permissions/logouts) with user information hold in a JPA…
ngeek
  • 7,733
  • 11
  • 36
  • 42
158
votes
16 answers

What is the best Distributed Brute Force countermeasure?

First, a little background: It is no secret that I am implementing an auth+auth system for CodeIgniter, and so far I'm winning (so to speak). But I've run into a pretty non-trivial challenge (one that most auth libraries miss entirely, but I insist…
Jens Roland
  • 27,450
  • 14
  • 82
  • 104
157
votes
19 answers

HTTP authentication logout via PHP

What is the correct way to log out of HTTP authentication protected folder? There are workarounds that can achieve this, but they are potentially dangerous because they can be buggy or don't work in certain situations / browsers. That is why I am…
Josef Sábl
  • 7,538
  • 9
  • 54
  • 66
157
votes
3 answers

passport.js RESTful auth

How does one handle authentication (local and Facebook, for example) using passport.js, through a RESTful API instead of through a web interface? Specific concerns are handling the passing of data from callbacks to a RESTful response (JSON) vs using…
ryanrhee
  • 2,550
  • 4
  • 23
  • 25
154
votes
10 answers

Google Authenticator available as a public service?

Is there public API for using the Google Authenticator (two factor authentication) on self-running (e.g. LAMP stack) web apps?
ohho
  • 50,879
  • 75
  • 256
  • 383