Authentication on the Web (Sessions, Cookies, JWT, localStorage, and more)

In this video, we will cover the fundamentals of user authentication in modern web applications and websites. In particular, we will explore stateful (session-based) and stateless (token-based) auth, and examine cookies, JWT, and client storage in close detail. We will also touch on security aspects inherent with each authentication scheme and lay out practical strategies for implementing authentication in single-page apps and RESTful APIs.
This episode is also a companion for the MERN stack series where we build a GraphQL API server with a React front-end • MERN Stack & GraphQL -... You will find however that the general principles in this presentation apply to many programming languages (Ruby, Python, PHP, JS) and frameworks (Rails, Django, Laravel, Express) on the web.
My intention with this presentation is to give you a bird's eye view of the popular authentication schemes, and lay the theoretical groundwork for the upcoming implementation tutorials with Node.js. Hopefully, this video will clear up some of the common questions or uncertainties revolving around user auth. Let me know down below if you found it useful. I'll see you devs soon.
Markdown presentation with resources and links on GitHub github.com/alex996/presentations

[@agustinbs]

Best video on web auth that has ever been produce by the mankind. Period.

[@BlokeBritish]

produced by mankind but seems more like a machine just reading some text

[@benedictsincere7366]

i guess im asking randomly but does someone know of a trick to get back into an Instagram account..? I was dumb forgot my password. I love any tips you can give me.

[@JoonhwanLee]

2 years after, still best I think

[@hellelo.5840]

@@BlokeBritish actually its the best made by mankind, watch something else if you can't grasp it.

[@BlokeBritish]

@@hellelo.5840 first grasp what i said and then reply

[@MasonE81]

Dude. You are the man. The world needs more videos like this.

[@medi7573]

This video cant be better than it is now, dead simple, concise, strictly to the point,thank you so much for the GREAT content , keep up

[@vabolshakov]

It can, if the author would tell about signed cookie based session

[@twiggeh3577]

this is still, a year later, the best resource that I've found on cookies and sessions! Chapeau

[@NikogBazza]

This is the kinds of videos that I've been looking for like 3 years, Thank you so much Sr.

[@nitindaphale2008]

LIKE from INDIA. At least 15 videos, 10 articles, countless days I spent to understand (10%) about authentication techniques and you refreshed that knowledge in one shot!

[@ArthurBurgan]

You're the man! It's incredible that we can consume this content for free in such a concise yet thoroughly delivered manner. A big thank you for the time you put in creating these videos and for sharing your knowledge with us!

[@Oswee]

I would LOVE to hear the same topic but in context of SPA & WebSockets authentication (distributed micro-service systems). This is the No.1 explanation in the whole KZbin! You have a talent!

[@awabelmahe9700]

My goodness, man, not a single second wasted, just a non-stopping flow of information. Your videos are the best on the whole internet; concise, packed, and straight to the point. Thank you very much for what you're doing.

[@onieltoledo8019]

Awesome video, thanks for this amazing presentation! Concise, to the point, with no jargon but you didn't miss any vital info. Many Thanks!

[@fb_a]

This video must be the *prerequisite* video for every web development/backend course out there. Thanks, man! crystal clear explanation!

[@tylersmith8245]

This is the most concise and informative resource I've ever seen covering web authentication. Thank you for making this.

[@MrFallout86]

one of the damn best video I've seen on the topic. Well done sir! And thank you!

[@girmamoges941]

No one had explained like this, it is exceptional and beyond any online presentation that mankind has ever encountered. Absolutely Phenomenal. If a grade has to be given to you, you deserve for five courses in a term with a grade of A+, A+, A+, A+ , A+ with flying colors, or in simple terms " very great distinction" .

[@xpfe5zrm]

This is an amazing video. Very informative, and has little bias so that I can consider the trade offs for myself. Thank you for making this!

[@bholowasia]

Thanks for all your sessions! One thing on your note on horizontal scaling with session/cookies : once offloaded onto a distributed cache (say redis cluster with consistent hashing for shards) there shouldn't be a problem. If sessions are lost (in case we don't use redundant nodes to backup the session in redis-slave-nodes) - in most cases that should be acceptable. The user only needs to re-login.

[@Sybrid203]

Wow man, I am amazed by how you simplified everything! Awesome video, made my understanding of all the auths concrete after I watched this video. You're amazing!

[@jaycelila6258]

hey you! solve most of the missed bridges in my brain. you deserve thumbs up

[@peloquin74]

Your video was a great teaching tool for my interns. You make the complicated simple. WELL DONE SIR!

[@fooked1]

This video summarizes hours of other videos and blog posts all over the Internet. Well done.

[@argeelearner3978]

Wow!! Thanks bro for sharing. I see you put a lot of work into this video and it is really appreciated. I thought I can just watch this video but I see that i need to LEARN this video and it wont take me one sitting. Thanks again.

[@wargaming67]

This is exactly what I was looking for. Concise but informative explanation. Thank you!

[@spencerwilson-softwaredeve6384]

Hey I know this is an old video, but this video is what secured these concepts in my head. Every second of the video is high quality information with very little noise. Thanks!

[@kaushikplays4676]

Best video one could get on Security. Underrated channel. Thanks!

[@Aman-rm1hq]

This is brilliant, you made so many concepts easier to understand in a simple video

[@blankblank1273]

Timestamps: Authentication: 0:16 Session Auth/Flow: 1:24 Session Auth/Features: 2:21 Cookies: 4:10 Cookies/Security: 5:50 Cookies/Attributes: 7:14 Cookies/Flags: 8:02 CSRF: 8:47 Tokens/Flow: 9:35 Tokens/Features: 10:53 JWT: 13:04 JWT/Security: 16:23

[@robertgardzinski6424]

Your video helped me a lot to understand authentication. You put it short and simple. Thank you! Guys like you makes the Internet a better place. :)

[@germanrocha6186]

Excellent explanation. It covers everything you need to now about web auth. It saved me a lot of time and effort to learn it on my own. Very compact and clear. Thank you!!

[@ninadmanjaramkar9062]

This is the single most amazing piece of information on web auth on the entire internet. Wow.

[@edwinlopez7932]

Super valuable. Thanks for the breakdown and thoroughness.

[@TheLordoftheDarkness]

Finally, an explanation for web authentication for people who are not 5 years olds.

[@seanlanghi9782]

Incredible quality and quantity of information here. I'm so grateful for this video. Thank you. (I'm a startup founder who's learning how to build a Web frontend!)

[@vanyka]

Cheers for keeping it short and to the point bro. Very informative, so definitely a thumbs up!

[@khalidben9940]

so far the best video I encountered.Thank you for this amazing content.I am waiting for more like this

[@t0khyo]

This video is my top pick for the year. Thanks for the awesome content - it really made a humongous difference for me!

[@venkataswamy355]

I spent days of time to understand the specified concepts but with this video opened my eyes.. Wonderful Work Sir! Please keep posting or refer if you already have anything related to OWASP Top 10 testing

[@saikk5710]

I really enjoyed this video. You sir are a professional developer with very good presentation skills

[@BharCode09]

Full, comprehensive, unbiased and objective unlike most of the speakers go gaga about 1000% STATELESS blah blah! Only REAL benefit I can think of jwt is, that it can mitigate DDSA, that a Front End service, which can reject the request with a just simple signature verification made on JWT, instead of every time going down to authenticate and then reject, as in the case of stateful.

[@mrchi6611]

Wow. Talk about clarity.... I appreciate the effort. Your content is GOLD

[@idhasitha]

thank you very much for your time spend to create this, everything is here no need to watch any other video or blog regarding Authentication :)

[@raghualapati4839]

cudos . This is THE BEST explination of session and token i have ever seen and in so much depth and details. Can't thank you enough guys. The best of the best..

[@jitender83601]

One of the best video on the JWT and session token management. Great work!

[@JuanFrutos98]

Thanks, man. You really made everything clear for me now. I'm really thankful for your efforts.

[@kevgits]

What a comprehensive and well-put-together vid! Thanks a lot!

[@davidjiang7929]

This information was really useful for me. I'm just starting webdev and wanted to learn more about how to keep the sessions secure. Thank you!

[@omnipoten8]

The best explanation that I ever came across ! Thank you very much !

[@shreyagarwal7113]

Thanks for the effort you put to make it easy to understand. Thank you so much. Now I have more clarity about authentication. Keep making more such videos.

[@MrKeepItTrill]

Amazing video, makes these concepts easy to understand. Thank you!

[@_dhruvawasthi]

An excellent video! Includes everything that I was looking for

[@sbase20d]

The very best on this topic, very clearly and precisely described, bravo!

[@richardkulling1432]

What a great video, clears many questions I had!

[@nivellen1168]

Thank you very much for this video. I've been struggling with this for quite a while.

[@muradmomani8170]

Really one of the best videos on that topic ! Thanks for such great info

[@tenminutetokyo2643]

Very straightforward and clear. Excellent. Thanks.

[@Middollo]

Exactly what ive been looking for. 🚀 thank you so much!

[@JimLloyd1]

Nicely done. Clear and concise. One tiny quibble: The word "opaque" should be pronounced as "oh-pake", not as "oh-pack". It is a word borrowed from optics, where it means non-transparent. One might say that a one-way mirror is transparent on one side and opaque on the other.

[@karma_yogi_42]

i tried this same style to create a tutorial on php. i got pummeled down with down votes. people didt like it when i read out from a slide show. but you! you have done a great service to a lot of people. thank you!

[@AbdulBasit-ib6by]

Thank you, Dude. I am very excited to watch this video full of Auth mechanism inside Almost complete information about different Auth mechanism. It's Superb

[@ClearlyCero]

The video is actual gold, good job mate

[@vpetevotov]

Best video about web auth I've ever seen

[@aladdinovich]

I love you man, you really made so clear and informative video. I really appreciate your efforts.

[@sanketgawande3667]

Thank you so much sir for this detailed session on client side web security and cookies session things .

[@ashokrajur09]

best presentation on authentication and its details.. thanks for your time in explaining it very clearly.. appreciate it.

[@prasathj7436]

Thanks for the excellent video. Clarified few doubts I had. Keep it going.

[@clashoffans496]

Thanks a lot! This is the only well-explained content i found on the internet.

[@ziaahmad8738]

dude just thank u very much i was so confused but i am relieved now. Perfect.

[@athisii_ekhe6167]

Beautifully explained and cleared my doubts. Thank you.

[@ghazini47]

Thanks so much for the best video on JWT & Session based authentication.

[@AnDreisSh0W]

Amazing, complete and we have a good resource to learn!

[@prayasarora]

Thank you so much for providing so easy explaination .

[@tales4604]

Authentication suddenly became easy. Thanks a lot, sir!

[@SkyFly19853]

Thank you sooooo much for this clear explanation!!!! 💯💯💯💯💯💯

[@sanzhar.danybayev]

Thank you! Quite versatile and profund research!

[@emanuelfaisca1783]

Excellent video with great explanation of topics! Thanks

[@muj1003]

Best video on Auth. Deserves to be ranked higher by KZbin ...

[@anindian2055]

This is PERFECT. Thank you for the wonderful content. Learned a lot as a penetration tester.

[@chrislonardo]

Excellent explanation, I finally get it. Thank you.

[@reemachourey9462]

Very nicely explained. Many thanks for sharing the notes.

[@jeromelanteri6469]

good video, i do write a document from your video to save knowledges around. Thank you very much because this clarify many things i didn't really understood good about JWT and user autorization/authentication technics used.

[@DennisIvy]

Great video! I appreciate you putting this together :)

[@rajeshranjan7034]

Thankyou so much for providing the clear and precise information

[@123thebruno]

the didactics of the video are excellent, congratulations .

[@stiffyBlicky]

Great videos. Straightforward, no bullshit. Thank you.

[@rinakanishi]

You're a lifesaver. I can't thank you enough!!

[@ericcartman4799]

Best auth tutorial I have watched. Thanks you

[@kharbandaumang]

So simple and effective video... Just subscribed the channel.. Thanks a ton for putting this video out.

[@baluhyajr.913]

I enjoyed very much this presentation.

[@connormccafferty5288]

Extremely clear explanation.

[@anubhavkumarrao3141]

this is the best video on youtube for "Authentication" :)

[@rahulek914]

Excellent and thorough. Thanks!!

[@tedkollker3984]

Very important information! Thank you very match! But one thing that can be improved: The changing of topics is without any notice, I am sure that if you will give a prominent header to a new topic, it will be even better

[@prasundas4155]

while watching this video I was like damm this is what I needed. Thank you sir

[@masoomanaqvi5107]

excellent video. I watched many on different bits but this should have been the first one

[@_khaledg]

Thank you so much for this video, it cleared many things for me. Could you please touch on storing JWT in Cookies instead of ( LOCAL storage / session storage )

[@VeerBhagat17]

Thanks You so much for great content. Great video. Love you.

[@TechPoint56]

One tip is to watch this video after having some idea on this topics then it will clear all your doubts and be very useful, this I'm saying because a beginner might have difficulty registering all this as I had some time ago.

[@wilsonemmanuel1352]

This is amazing. Very clearly explained ❤

[@eugenedumoga677]

Very very very very very very very very very very very very very very very..........on point. Sums everything on authentication simply! Great content!

[@fleskimiso]

Excellent video for overview of auth on the web.

[@jmarioguedes]

Excelent video! Hugs from Brazil.