Authentication & sessions

Authentication & sessions

Authentication proves who a user is (login); authorisation decides what they can do. Sessions or tokens (like JWTs) remember a logged-in user between requests.

Never store plain passwords — hash them. Never trust the client — always re-check permissions on the server.