Designing Authentication Architecture
1. Designing JWT-Based Authentication
| Aspect | Detail |
|---|---|
| Structure | header.payload.signature |
| Algorithm | RS256/ES256 (asymmetric) preferred over HS256 |
| Lifetime | Access: 5–15 min; Refresh: days |
| Stateless | No server session lookup |
| Pitfalls | Hard to revoke; keep small; verify exp/aud/iss |
Example: JWT verification (Java)
JWT.require(Algorithm.RSA256(publicKey, null))
.withIssuer("auth.example.com")
.withAudience("api")
.build()
.verify(token);
2. Designing OAuth2 / OpenID Connect Architecture
| Flow | Use Case |
|---|---|
| Authorization Code + PKCE | SPA, mobile, web (recommended) |
| Client Credentials | Service-to-service |
| Device Code | TVs, CLIs |
| Implicit / Password | Deprecated |
| OIDC | Adds id_token (identity) on top of OAuth2 |
3. Designing Session-Based Authentication
| Element | Detail |
|---|---|
| Session ID | Random 128-bit; HttpOnly Secure SameSite=Lax cookie |
| Store | Redis / DB |
| Sliding expiry | Renew on activity |
| Revocation | Delete server-side record |
| CSRF protection | Required for cookie-based |
4. Designing API Key Authentication
| Practice | Detail |
|---|---|
| Storage | Hash (e.g., SHA-256) — never plain |
| Prefix | "sk_live_" for scanability |
| Scoping | Limit permissions per key |
| Rotation | Easy regeneration; overlap window |
| Rate limiting | Per-key |
5. Designing Single Sign-On (SSO)
| Protocol | Detail |
|---|---|
| SAML 2.0 | Enterprise; XML-based |
| OIDC | Modern; JSON/JWT |
| IdP | Okta, Azure AD/Entra, Auth0, Keycloak |
| JIT provisioning | Create user on first login |
| SCIM | Lifecycle sync |
6. Designing Multi-Factor Authentication
| Factor | Detail |
|---|---|
| TOTP (RFC 6238) | Google Authenticator, Authy |
| WebAuthn / Passkeys | Phishing-resistant; recommended |
| SMS / Email OTP | Weakest; SIM-swap risk |
| Push notifications | Number matching to prevent fatigue |
| Recovery codes | One-time backup codes |
7. Designing Token Refresh Mechanisms
| Strategy | Detail |
|---|---|
| Refresh token rotation | New refresh on each use; old invalid |
| Reuse detection | Revoke chain if old refresh reused |
| Storage (web) | HttpOnly Secure cookie |
| Storage (mobile) | Secure enclave / Keystore |
8. Designing Token Revocation Strategy
| Approach | Detail |
|---|---|
| Short-lived access | Natural revocation via expiry |
| Refresh blocklist | DB / Redis set of revoked jti |
| Token introspection | OAuth2 RFC 7662 endpoint |
| User version stamp | Invalidate all tokens by bumping |
9. Designing Passwordless Authentication
| Method | Detail |
|---|---|
| Magic link | Signed URL via email; short TTL, single-use |
| Email/SMS OTP | 6-digit code |
| Passkeys (WebAuthn) | Best UX + security |
| Push approval | Confirmed on trusted device |
10. Designing Identity Provider Integration
| Element | Detail |
|---|---|
| Federation | Trust external IdPs (social, enterprise) |
| Account linking | Same email → merge accounts (verify) |
| Claims mapping | IdP attributes → app user fields |
| Discovery | Email-domain → IdP routing |
11. Designing Device Authentication
| Mechanism | Detail |
|---|---|
| Device fingerprint | Detect new device → step-up auth |
| Trusted device cookie | Skip MFA on remembered device |
| Device flow | OAuth2 device code for input-constrained |
| Mutual TLS | Cert per device for IoT/B2B |
12. Designing Biometric Authentication
| Aspect | Detail |
|---|---|
| Local match | FaceID/TouchID never leaves device |
| WebAuthn binding | Biometric unlocks platform authenticator |
| Fallback | PIN / password |
| Don't store templates | Server only sees attestation |