Session
The server keeps the login state and the browser keeps an opaque session identifier.
Authentication Basics for Web Apps
Authentication answers “who is this user?” before an application allows private actions.
Authentication verifies an identity. Authorization decides what that identity is allowed to do. They work together: a user may prove that they own an account, but the backend must still check whether that account can edit a particular project.
Authentication is a conversation between the browser and backend: the user proves an identity, the server creates a trusted login state and each protected request is checked before it changes data.
Protect passwords
Never store a plain password. Hash it with a slow, modern password hashing algorithm on the server and compare hashes during login. Keep authentication logic away from client-only code.
Use HTTPS so credentials cannot be read in transit, validate email and password input, and return a general login error instead of revealing whether an account exists. Store reset tokens as short-lived, single-use values.
Sessions and tokens
A session stores a server-side login record and gives the browser a secure cookie. Token-based systems send a signed token with requests. In both cases, use HTTPS, short-lived credentials where practical and safe cookie settings such as HttpOnly, Secure and an appropriate SameSite value.
Token
A signed credential carries claims that the server verifies before accepting a request.
Authorization
A permission check confirms that this authenticated user may access this exact resource.
Authorize every sensitive action
Authentication identifies a user; authorization checks what that user may do. Validate ownership and permissions on the backend for every protected operation, even when the interface hides the button.
Reduce abuse
Protect login and password reset routes with rate limits, expire sessions when appropriate and provide a clear logout action. Log suspicious failures without recording passwords or full tokens. Small details reduce risk without making the user experience confusing.