Authentication & Access Control

Authentication answers "who are you?", authorization (access control) answers "what are you allowed to do?". Getting both right is one of the highest-leverage things you can do for an application's security.

Strong password practices

• Enforce a minimum length (length matters far more than forcing arbitrary symbol/number rules).
• Check new passwords against known breached-password lists, not just complexity rules.
• Never limit maximum password length aggressively or block pasting into password fields, both push users toward weaker, reused passwords.

Multi-factor authentication (MFA)

MFA requires two or more of these independent factors:

1. Something you know (a password, a PIN)
2. Something you have (a phone, a hardware security key)
3. Something you are (a fingerprint, facial recognition)

Even if a password is stolen through phishing, MFA stops most account takeovers because the attacker also needs the second factor.

The principle of least privilege

Every user, process, and service should have the minimum access needed to do its job, nothing more. A web server that only needs to read a database table shouldn't have a database account that can also drop tables.

Role-based access control (RBAC)

Rather than granting permissions to individuals one by one, RBAC groups permissions into roles (like STUDENT, INSTRUCTOR, ADMIN), and assigns users to roles. This makes access easy to reason about and audit, when someone changes teams, you change their role, not a long list of individual permissions.

// Checking a role before allowing an action, a simple RBAC check
function requireRole(user, ...allowedRoles) {
  if (!allowedRoles.includes(user.role)) {
    throw new Error('Forbidden: insufficient permissions');
  }
}