Questions tagged [authentication]

Authentication is the process of providing a proof of identity or verifying identity.

Authentication is the process of providing a proof of identity or verifying identity. This might involve confirming the identity of a person or software program, tracing the origins of an artifact, or ensuring that a product is what its packaging and labeling claims to be. Authentication is different than Authorization, which is the step of allowing access to a resource. Authentication and authorization usually happen together to verify identity and then allow access.

The first type of authentication is accepting proof of identity given by a credible person who has evidence on the said identity, or on the originator and the object under assessment as the originator's artifact respectively.

The second type of authentication is comparing the attributes of the object itself to what is known about objects of that origin. For example, an art expert might look for similarities in the style of painting, check the location and form of a signature, or compare the object to an old photograph.

The third type of authentication relies on documentation or other external affirmations.

Factors and identity

The ways in which someone may be authenticated fall into three categories, based on what is known as the factors of authentication: something the user knows, something the user has, and something the user is. Each authentication factor covers a range of elements used to authenticate or verify a person's identity prior to being granted access, approving a transaction request, signing a document or other work product, granting authority to others, and establishing a chain of authority.

74922 questions
129
votes
9 answers

Salt and hash a password in Python

This code is supposed to hash a password with a salt. The salt and hashed password are being saved in the database. The password itself is not. Given the sensitive nature of the operation, I wanted to make sure everything was kosher. import…
Chris Dutrow
  • 48,402
  • 65
  • 188
  • 258
129
votes
3 answers

Google Authenticator implementation in Python

I am trying to use one-time passwords that can be generated using Google Authenticator application. What Google Authenticator does Basically, Google Authenticator implements two types of passwords: HOTP - HMAC-based One-Time Password, which means…
Tadeck
  • 132,510
  • 28
  • 152
  • 198
129
votes
6 answers

What method should I use for a login (authentication) request?

I would like to know which http method I should use when doing a login request, and why? Since this request creates an object (a user session) on the server, I think it should be POST, what do you think? But since the login request should be…
greg0ire
  • 22,714
  • 16
  • 72
  • 101
126
votes
3 answers

REST API Token-based Authentication

I'm developing a REST API that requires authentication. Because the authentication itself occurs via an external webservice over HTTP, I reasoned that we would dispense tokens to avoid repeatedly calling the authentication service. Which brings me…
cantlin
  • 3,236
  • 3
  • 21
  • 22
126
votes
2 answers

How to do stateless (session-less) & cookie-less authentication?

Bob uses a web application in order to achieve something. And: His browser is on diet, therefore it does not support cookies. The web application is a popular one, it deals with a lot of users at a given moment - it has to scale well. As long as…
125
votes
6 answers

How to manually set an authenticated user in Spring Security / SpringMVC

After a new user submits a 'New account' form, I want to manually log that user in so they don't have to login on the subsequent page. The normal form login page going through the spring security interceptor works just fine. In the new-account-form…
David Parks
  • 30,789
  • 47
  • 185
  • 328
125
votes
21 answers

Swift add icon/image in UITextField

I would like to add icon/image in UITextField. The icon/image should be left to placeholder. I tried this: var imageView = UIImageView(); var image = UIImage(named: "email.png"); imageView.image = image; emailField.leftView = imageView; Thanks.
informatiker
  • 2,769
  • 4
  • 17
  • 13
124
votes
5 answers

Best practices for server-side handling of JWT tokens

(spawned from this thread since this is really a question of its own and not specific to NodeJS etc) I'm implementing a REST API server with authentication, and I have successfully implemented JWT token handling so that a user can login through a…
JHH
  • 8,567
  • 8
  • 47
  • 91
122
votes
23 answers

Sourcetree remote: Invalid username or password

Im trying to push to github with sourcetree but get the following error: git -c diff.mnemonicprefix=false -c core.quotepath=false push -v --tags origin live_version:live_version remote: Invalid username or password. fatal: Authentication failed…
Sven van den Boogaart
  • 11,833
  • 21
  • 86
  • 169
122
votes
4 answers

Why use an API key and secret?

I came across many APIs that give the user both an API key and a secret. But my question is: what is the difference between both? In my eyes, one key can be enough. Say I have a key and only I and the server know it. I create a HMAC hash with this…
EsTeGe
  • 2,975
  • 5
  • 28
  • 42
122
votes
4 answers

ASP.NET Web API Authentication

I am looking to authenticate a user from a client application while using the ASP.NET Web API. I have watched all the videos on the site and also read this forum post. Putting the [Authorize] attribute correctly returns a 401 Unauthorized status.…
Mujtaba Hassan
  • 2,495
  • 2
  • 20
  • 29
121
votes
15 answers

how to log in to mysql and query the database from linux terminal

I am using debian linux. I have a linux machine on which mysql is install. I can log in to my linux machine using root user as well as other user. I can connect to mysql database on linux machine from windows machine using sqlyog. Now I want to…
Param-Ganak
  • 5,787
  • 17
  • 50
  • 62
121
votes
6 answers

Where to store the refresh token on the Client?

My SPA application uses the following architecture (source): This assumes that my client application knows about the refresh token, because I need it to request a new access token if no user credentials (e.g. email/password) are present. My…
Robin Wieruch
  • 14,900
  • 10
  • 82
  • 107
120
votes
8 answers

Python request with authentication (access_token)

I am trying to use an API query in Python. From the command line I can use curl like so: curl --header "Authorization:access_token myToken" https://website.example/id This gives some JSON output. myToken is a hexadecimal variable that remains…
user1895406
  • 1,383
  • 2
  • 9
  • 10
119
votes
9 answers

RESTful web service - how to authenticate requests from other services?

I am designing a RESTful web service that needs to be accessed by users, but also other web services and applications. All of the incoming requests need to be authenticated. All communication takes place over HTTPS. User authentication is going to…