Authentication Systems in Modern Web Apps: JWT, OAuth, Session Management

Security has become one of the building blocks of modern Web Apps. Users want quick, hassle-free access, and they want their information to be secure. This equilibrium between security and convenience falls on authentication.

Modern authentication goes beyond maintaining usernames and passwords on a database. Web Applications employ token systems, identity providers, session strategies, and security controls. Modern authentication goes beyond.

As modern applications become distributed, API-driven, and session-managed, authentication systems need to offer:

• Access from multiple devices
• Flexible user sessions
• Third-party authentication
• APIs with controlled access
• Permission and access management

Modern web application authentication has shown that security involves deep architecture and flexible, controlled options.

Strong opinion:
Many companies spend heavily on user interfaces, while exposing user data and their business infrastructure with poor authentication systems.

Modern authentication systems include JWT and OAuth and are dominant and standard for a reason.

JWT (JSON Web Tokens): Architecture, Workflow, and Use Cases

JWT (JSON Web Tokens)has become one of the more popular authentication systems for building modern applications.

JWTs are a small, self-signing means of transmitting user information across systems. The token itself contains the session information, as opposed to storage on a session database.

A JWT normally includes:

• Header
• Payload
• Signature

The process is simple:

• User inputs credentials
• Server checks credentials
• Server issues JWT
• Client keeps token
• Client includes token in future requests

This is effective in distributed and API based systems including microservices as the server does not need to remember the session state information for any user.

Here’s a simple comparison:

This kind of authentication is heavily used by companies like Netflix and Spotify as their systems are multi-service and multi-device.

Using JWT (JSON Web Tokens) almost always improves security, a notable exception being long-lived tokens, poor management for the tokens, and insecure token storage.

Strong opinion:
JWT includes many security improvements, but poor implementation by developers has degraded system security.

OAuth Authentication Flow Explained

OAuth Authentication provides the option of logging into applications that make use of Google, GitHub, Facebook, and other similar third parties as opposed to traditional application user accounts.

OAuth provides a third party application the ability to perform certain actions on a user's account on behalf of the user by granting permission to the application.

The basic process in OAuth looks like this:

• User chooses a third party authentication mechanism
• User authenticates with third party
• Third party gives permission through a special code
• Application can perform on behalf of the user
• User is given access

This creates a need to reduce number of credentials to be remembered by the user or by the application

Current OAuth usage generally awaits:

• OAuth 2.0
• OpenID Connect (OIDC)
• PKCE for mobile security

Centralized identity management is one of the key benefits. Companies reduce the risks associated with password management while providing a more user-friendly experience.

According to Google, account systems that incorporate federated identity management and multi-factor authentication report significantly less account compromises.

Slack is a good example of a company that allows multiple OAuth providers which makes setup easier and controls access management.

Personal perspective:
Having a new password for every new site is a bad practice and increases risk to the systems more than it protects them.

Access Tokens, Refresh Tokens, and Secure Token Handling

Access Tokens and refresh tokens are important in the current systems for the management of secure sessions.

Access tokens give temporary rights to access resources and refresh tokens allow the creation of new access tokens.

This improves user-friendliness and reduces the risks associated with token management.

A standard architecture looks like:

• Short access tokens
• Long refresh tokens
• New access tokens are created in the background

Best practices for secure tokens management are:

• Keep the tokens safe
• Always use HTTPS
• Refresh tokens should be replaced regularly.
• The usage of tokens should be limited.
• Tokens should have an expiration date.

One of the biggest mistakes is managing tokens in the browser without safekeeping.

A good example is a number of successful hacks on systems that provided poorly managed token-controlled access to their systems and user data.

Here’s a simplified breakdown:

Token-based systems supplemented with:

• Device fingerprinting
• IP monitoring
• Behavioral analytics

Strong opinion:
Protecting the entire session lifecycle is what a solid authentication system is about, not just the login process.

Best Practices for Building Secure Authentication Systems

Implementing JWT or OAuth is not enough for building secure authentication systems.

Essentials include:

• Multi-factor authentication (MFA) Rate limiting
• Password hashing with bcrypt or Argon2
• HTTPS enforcement
• Secure cookie settings
• Role-based access control (RBAC)
• Session expiration policies

Monitoring suspicious behavior is another critical area for authentication systems.

• Brute force attacks
• Credential stuffing
• Unusual login locations
• Rapid session switching

Based on stats from Microsoft, implementing MFA can help block over 99% of automated attacks on accounts.

Improved account protection for GitHub was the outcome of strengthened policies and multi-factor authentication for developers.

Zero trust security models where users are not trusted by default after logging into a system but permissions and behaviors are continuously verified are also becoming common.

Strong opinion:
Weak authentication is not a technical failure on your part, but a failure on your part as a business.

Choosing the Right Authentication Strategy for Your Web Applications

Only some methods of authentication are suitable for all systems. When determining the best method of authentication, consider the following:

• Scale of the application
• Behavior of the users
• Security demand
• Architecture of the API
• Compliance needs

For example,

• Internal systems might work fine with sessions.
• JWT works best with API driven systems.
• Token authentication, alongside OAuth, is common in consumer platforms.

It's not uncommon for large scale web applications to combine all three methods above. They're OAuth for identity, JWT for API interaction, and sessions for managing a limited set of workflows.

Keep in mind that authentication methods can be stateless. In distributed cloud systems, stateless authentication can perform even better than sessions, since that reduces session management on the server side.

Airbnb is a layered authentication system example supporting many users on their web and mobile applications.

Strong opinion:
The most unorthodox method of authentication fails in developer preference. Authentication is an important aspect of application architecture.

Final Thoughts

Modern authentication methods should never be considered merely a login feature. As Web Applications grow and become API-centric, secure identity management is an even greater priority.

Businesses wield useless and protected methods. From JSON Web Tokens to OAuth authentication and access tokens to multilayered secure authentication, best exhaust the systems.

Authentication Issues:

• Poor token storage
• Session management flaws
• No multi-factor authentication
• Tokens with excessive lifespan
• Unsafe API connectivity

Recommendations:

• Utilize tokens with shorter lifespans
• Be very careful with refresh tokens
• MFA should be used wherever you can
• Keep an eye on suspicious logins
• Control access based on least privilege

Personal Take:
To me, authentication shortcuts are inexcusable. Authentication is an indispensable layer of security in the digital world.

Ready to Build Secure Authentication Systems?

At Crescentic Digital, we take care of authentication design for the new wave of Web Apps and corporate software. Our authentication systems adapt to fit the unique structure of your business.

Want all of the above?

Visit our Contact Page and we will build customized and modern authentication systems.