Security
Security Patterns
Security is not a feature â it's a requirement. Authentication, authorization, encryption, and secure communication must be designed into the system from the start.
- Authentication â Verify identity
- Authorization â Enforce access control
- Encryption â Protect data in transit and at rest
Security is only as strong as its weakest link.
Authentication
Verifying that a user is who they claim to be.
Authentication Factors
| Factor Type | Examples |
|---|---|
| Knowledge | Password, PIN, security questions |
| Possession | Phone (SMS/authenticator app), hardware token |
| Inherence | Fingerprint, face recognition, retina scan |
JSON Web Tokens (JWT)
JWT Structure
Header.Payload.Signature
eyJhbGciOiJIUzI1NiJ9.eyJ1c2VyX2lkIjoiMTIzIiwicm9sZSI6ImFkbWluIn0.abc123signature
| Part | Contents |
|---|---|
| Header | Algorithm (HS256, RS256), token type |
| Payload | User ID, roles, expiration, custom claims |
| Signature | HMAC or RSA signature for verification |
JWT vs Session Tokens
| Aspect | JWT | Session Token |
|---|---|---|
| Storage | Client (localStorage/cookie) | Server (Redis/DB) |
| State | Stateless | Stateful |
| Scalability | Excellent (no server state) | Requires shared store |
| Revocation | Difficult (until expiry) | Easy (delete session) |
| Size | Larger (contains claims) | Smaller (opaque ID) |
OAuth 2.0
Delegated authorization framework for third-party access.
Authorization
Controlling what authenticated users can access.
RBAC vs ABAC
| Model | Description | Example |
|---|---|---|
| RBAC | Permissions assigned to roles | Admin can delete, User can read |
| ABAC | Permissions based on attributes | Allow if user.department == resource.owner |
Encryption
Protecting data in transit and at rest.
TLS (Transport Layer Security)
Security Best Practices
| Practice | Description |
|---|---|
| Principle of least privilege | Grant minimum necessary permissions |
| Defense in depth | Multiple security layers |
| Input validation | Validate and sanitize all inputs |
| Output encoding | Encode output to prevent injection |
| Rate limiting | Prevent brute force and abuse |
| Audit logging | Log all security-relevant events |
| Secret management | Never commit secrets; use vaults |
Practice Exercises
-
Design: Design an authentication system for a SaaS application supporting OAuth 2.0, SAML, and email/password. Include token refresh, session management, and MFA.
-
JWT: Implement JWT-based authentication with access tokens (15-minute expiry) and refresh tokens (7-day expiry). How do you handle token revocation?
-
Authorization: Design an RBAC system for a hospital management system with roles: doctor, nurse, admin, patient. Each role has different access to patient records.
-
Encryption: Design encryption at rest for a database storing medical records. Include key management, rotation, and compliance requirements (HIPAA).
What to Learn Next
-> Service Mesh Envoy, Istio, and automatic mTLS.
-> Proxy and Reverse Proxy Forward proxy, Nginx, and SSL termination.
-> Rate Limiting Token bucket, sliding window, and distributed rate limiting.
-> CDN Edge caching and security at the edge.
-> Observability Logging, metrics, tracing, and monitoring.
-> API Design REST, GraphQL, gRPC, and API security.