Authentication Architecture: From Login to Secure Sessions
How modern web applications handle user identity, from password hashing to JWT-based sessions.
Authentication — verifying who a user is — is a critical component of any web application that handles user data. Getting authentication wrong can lead to data breaches, unauthorized access, and regulatory violations. Understanding how it works end-to-end helps engineers build secure systems.
Password handling is the first layer. When a user creates an account, their password is never stored directly. Instead, it's processed through a one-way hash function (like bcrypt or Argon2) that produces a fixed-length string called a hash. This hash is what's stored in the database. When the user logs in, the submitted password is hashed and compared to the stored hash. Even if the database is compromised, attackers cannot reverse the hash to recover the original password.
Session management begins after successful authentication. The server generates a JSON Web Token (JWT) — a signed, encoded token containing the user's ID and metadata. This token is sent to the client and included with every subsequent API request. The server validates the token's signature to confirm it wasn't tampered with and checks the expiration timestamp to ensure it's still valid.
Token refresh is essential for security. Access tokens should have short lifetimes (15–60 minutes). When an access token expires, the client uses a refresh token to obtain a new one without requiring the user to log in again. Refresh tokens are stored securely (typically in an HTTP-only cookie) and have longer lifetimes. This architecture limits the damage if an access token is leaked.
Authorization is distinct from authentication. Authentication answers 'who is this user?' Authorization answers 'what can this user do?' In the YR NOVATECH platform, we use role-based access control — users are assigned roles (intern, admin) that determine their permissions. An intern can view their own tasks and submit work. An admin can view all internships, assign tasks, approve submissions, and issue certificates.
Multi-layer security means implementing checks at every level: the frontend prevents unauthorized UI access, the API validates permissions before processing requests, and database RLS policies enforce access rules even if the API layer has bugs. This defense-in-depth approach ensures that no single point of failure can compromise user data.