Auth & Authorization

The part everyone gets wrong: sessions versus tokens, hashing passwords the right way, JWTs from the inside out, the OAuth 2.0 and OpenID Connect dance, and modeling who-can-do-what with RBAC, ABAC and scopes.