Question 1

What is OAuth actually for?

Accepted Answer

**Delegated authorisation** — letting an application act on a user's behalf against another service, **without the user handing over their password.** It is frequently described as a login mechanism, which is a misunderstanding that causes real security problems.

**The problem it solves.** Before it, an application that needed your data from another service asked for your username and password for that service. That gave it unlimited, permanent access to everything, indistinguishable from you. OAuth replaces this with **scoped, revocable, time-limited tokens**.

**The roles:** the **resource owner** (the user), the **client** (the application requesting access), the **authorisation server** (which authenticates the user and issues tokens), and the **resource server** (which holds the data).

**The flow, in outline.** The client redirects the user to the authorisation server; the user authenticates **there, not with the client**, and consents to specific scopes; the authorisation server returns a short-lived **code** to the client; the client exchanges that code, plus its own credentials, for an **access token**. The client never sees the password.

**Why the code exchange exists** rather than returning the token directly: it keeps the token out of URLs, browser history and referrer headers.

**The crucial distinction: OAuth is authorisation, not authentication.** An access token proves the client may access a resource — **it does not prove who the user is**, and using one as a login signal was the source of well-documented vulnerabilities. **OpenID Connect** is the layer built on top of OAuth that does authentication properly, adding an **ID token** with verified identity claims.

**What to use now:**

**Authorisation code flow with PKCE**, for essentially everything including mobile and single-page applications. **The implicit flow is deprecated.**

**Client credentials flow** for machine-to-machine, where no user is involved.

**What to get right:** validate the `state` parameter to prevent CSRF, register exact redirect URIs, request the narrowest scopes, and never accept tokens from an untrusted source without verifying them with the issuer.

Question 2

What is the difference between authentication and authorization?

Accepted Answer

Authentication establishes who someone is. Authorization determines what that identity is allowed to do. They are sequential: you cannot meaningfully decide permissions before you know the identity,

Question 3

What is the difference between HTTP 401 and 403?

Accepted Answer

The short version is that 401 concerns identity and 403 concerns permission. A 401 means the request was not authenticated: no credentials were supplied, or the ones supplied were not valid. A 403

Question 4

What is a JWT, and when should you not use one?

Accepted Answer

A JSON Web Token is a signed, self-contained token carrying claims — typically who the user is and when the token expires — which a server can verify without a database lookup. That property is its

Question 5

What are the different methods for implementing authentication in a Django REST API?

Accepted Answer

Django REST API authentication methods include Basic, Token, Session, OAuth2, and JWT authentication, each suited for different use cases and security requirements.

Question 6

How to implement authentication in Next.js?

Accepted Answer

Implementing authentication in Next.js can be done using NextAuth.js, JWT, or session-based methods. Each has its benefits and trade-offs depending on your app's needs.

Question 7

What are the best practices for REST API security?

Accepted Answer

Implementing best practices for REST API security, such as authentication, HTTPS, and input validation, is crucial for protecting sensitive data and preventing unauthorized access.

Related Questions