10. Security

Authentication

Authentication verifies who a user is. Common approaches:

Password-based: Username + password, validated against stored hash. Use bcrypt, scrypt, or Argon2 for password hashing.
OAuth 2.0 / OpenID Connect: Delegate authentication to a third party (Google, GitHub). OAuth 2.0 handles authorization; OpenID Connect adds identity layer.
SSO (Single Sign-On): One set of credentials across multiple applications via SAML or OIDC.
MFA (Multi-Factor Authentication): Additional factor beyond password (TOTP, SMS, push notification).
Biometric: Fingerprint, Face ID, voice recognition.

# OAuth 2.0 Authorization Code Flow
User clicks "Login with Google" → redirected to Google
Google asks for consent → Google redirects to app with code
Backend exchanges code + client_secret for access_token
Backend uses access_token to fetch user profile from Google API

Authorization

Authorization determines what a user can do after authentication.

Model	Description	Example
RBAC	Role-Based Access Control	Admin, Editor, Viewer roles
ABAC	Attribute-Based Access Control	"Can edit documents created in the last 30 days"
PBAC/PBAC	Policy-Based Access Control	IAM policies (AWS)
ACL	Access Control Lists	Per-object permissions (file systems)

# RBAC Policy (Pseudocode)
roles:
  admin: [read, write, delete, manage_users]
  editor: [read, write]
  viewer: [read]

def authorize(user, action, resource):
  user_roles = get_roles(user)
  return any(action in role.permissions for role in user_roles)

Data Protection

Encryption

In Transit: TLS/SSL encrypts data flowing between client and server. Use HTTPS everywhere.
At Rest: Encrypt data stored on disk. Database encryption (AES-256), file-level encryption, disk encryption.
End-to-End: Data encrypted on client, decrypted only on destination client. Servers cannot read the content.

Data Masking

Replace sensitive data (PII, credit card numbers) with masked versions in logs, dev databases, and UI: ****-****-****-1234.

Key Management

Use a Key Management Service (AWS KMS, Azure Key Vault, HashiCorp Vault) to store, rotate, and audit encryption keys. Never hardcode keys in source code.

Infrastructure Security

Network Segmentation: VPC, subnets, security groups, firewalls. Separate public-facing tiers from private data tiers.
WAF (Web Application Firewall): Filters HTTP traffic; blocks SQL injection, XSS, DDoS.
DDoS Protection: Cloudflare, AWS Shield, Azure DDoS Protection absorb large-scale attacks.
Rate Limiting: Prevent brute-force attacks and API abuse. Token bucket, leaky bucket, fixed window algorithms.
Secrets Management: Store API keys, credentials, certificates in a vault; rotate regularly.

Common Threats & Mitigations

Threat	Description	Mitigation
SQL Injection	Malicious SQL inserted into queries	Parameterized queries, ORM, input validation
XSS	Malicious scripts injected into web pages	Content-Security-Policy, output escaping, sanitization
CSRF	Cross-site request forgery	CSRF tokens, SameSite cookies
Man-in-the-Middle	Intercepting communication	HTTPS, certificate pinning, HSTS
DDoS	Overwhelming system with traffic	CDN, rate limiting, auto-scaling, scrubbing services

Exercise: Design an authentication and authorization system for a healthcare API. Requirements: patients can view their own records, doctors can view/edit assigned patients, admins can manage users. All access must be logged. Data must be encrypted at rest and in transit. Describe your auth model, encryption strategy, and audit approach.