Auth, Authorization & Multi-Tenancy

Who is this user, what can they do, and whose data should they see? Authentication (proving identity), authorization (granting permissions), and multi-tenancy (safe isolation between customers). Hashing passwords, managing sessions, issuing tokens, and the gotchas that leak data across tenants.

17 lessons

Study 72 cards for this domain

Beginner

Authentication vs authorizationBeginner5 min read·Not startedPassword hashing and secure storageBeginner5 min read·Not startedSessions and cookiesBeginner4 min read·Not startedMulti-factor authentication: TOTP and WebAuthnBeginner3 min read·Not started

Intermediate

JWT tokens and stateless authenticationIntermediate6 min read·Not startedOAuth2 and OpenID ConnectIntermediate5 min read·Not startedRole-Based Access Control (RBAC)Intermediate4 min read·Not startedAPI key authenticationIntermediate3 min read·Not startedAccount recovery and password reset done safelyIntermediate3 min read·Not startedRefresh tokens and token rotationIntermediate3 min read·Not started

Advanced

Multi-tenant data isolation patternsAdvanced6 min read·Not startedProduction authentication gotchasAdvanced6 min read·Not startedAuthorization frameworks and patternsAdvanced5 min read·Not startedReal security incidents and lessons learnedAdvanced6 min read·Not startedSingle sign-on and SAML basicsAdvanced3 min read·Not startedCSRF and XSS in the context of authAdvanced3 min read·Not startedAttribute-based access control vs RBACAdvanced3 min read·Not started