Day 102 of
#200DaysOfCodingChallenge 🚀
OAuth (Open Authorization): How Modern Login Systems Actually Work 🔐
Most modern applications don’t ask users to create yet another username and password.
Instead, they say:
“Sign in with Google.”
That flow is powered by OAuth.
What is OAuth?
OAuth (Open Authorization) is an open standard for token-based authorization.
It allows an application to access limited user data from another trusted service without ever seeing the user’s password.
OAuth answers this question:
“Can this app act on behalf of this user, and only within approved limits?”
Why OAuth Exists
Before OAuth:
• Apps collected passwords directly
• Password reuse caused massive breaches
• Trust was centralized and fragile
OAuth solves this by:
• Never sharing user passwords
• Using access tokens instead
• Letting users grant and revoke permissions
OAuth vs Traditional Login:
• Traditional authentication
• User gives email password to your app
• You store and protect credentials
Security responsibility is fully yours
OAuth authentication
User authenticates with a trusted provider (Google)
Provider issues a token
Your app trusts the provider’s verification
Result: less risk, better UX, stronger security
The OAuth Flow (Google Example)
1️⃣ User clicks “Login with Google”
2️⃣ App redirects user to Google.
3️⃣ User approves requested permissions.
4️⃣ Google sends back an authorization token.
5️⃣ App verifies the token.
6️⃣ User is logged in, no password exchanged.
At no point does your server see the Google password.
Passport.js: OAuth Made Practical
OAuth is powerful but complex.
Passport.js simplifies it by acting as an authentication middleware.
What Passport handles:
• OAuth strategies (Google, GitHub, etc.).
• Session management
• User serialization & deserialization
• Authentication state tracking.
You focus on logic, Passport handles protocol complexity.
Local Auth OAuth Together
A real system often supports:
• Email password login (local strategy)
• OAuth login (Google strategy)
Both lead to the same user session, but through different identity providers.
This allows:
• Flexible onboarding.
• Backward compatibility
• Secure migration paths
Password Security Still Matters:
Even with OAuth, local accounts must be secured properly.
Best practices applied:
• bcrypt hashing
• Salting salt rounds
• No plain-text passwords
• Slow, computationally expensive verification.
Passwords are never decrypted: only compared against hashes.
Sessions & Persistent Login
Authentication doesn’t end after login.
Sessions:
• Represent an authenticated user state
• Stored server-side
Cookies:
• Store session identifiers in the browser
• Automatically sent with each request
This enables:
• Persistent login
• Protected routes
• Secure access control
Environment Variables (.env)
Sensitive values must never live in source code.
Stored securely:
• Database credentials
• OAuth client secrets
• Session secrets
This prevents leaks and enables safe deployment across environments.
Final Principle 🧠
OAuth is not just “login with Google”.
It’s a delegated trust system built to:
• Reduce credential exposure
• Improve user experience
• Scale authentication securely
Modern authentication is layered by design:
• Hashing
• Tokens
• Sessions
• Middleware
Environment security
📘 Full structured notes architecture explanations here:
🔗 your Notion link :
notion.so/Authentication-and…
Follow
@Iris_of_Defi for clear Web Dev & Web3 education.