Controlling who can do what rests on the AAA framework: authentication, authorization, and accounting. Authentication verifies a user's identity, typically with credentials, tokens, or biometrics. Authorization determines what an authenticated user is allowed to do. Accounting, or audit logging, records who did what and when, supporting investigation and compliance. Identification claims an identity ("I am Alice") while authentication proves it. Strong authentication is critical because accounts are the gateway to nearly every other control, and a single weak password can unravel an entire security posture.
Multi-factor authentication (MFA) raises the bar by requiring two or more independent verification factors drawn from different categories: something you know, such as a password; something you have, such as a phone or hardware token; and something you are, such as biometrics. Even if one factor is compromised, an attacker still cannot access the account without the others. Two-factor authentication (2FA) is the specific case of MFA using exactly two factors. Modern passwordless standards build on public-key cryptography: passkeys are device-bound, phishing-resistant credentials with no shared secret; WebAuthn is the W3C standard that underpins them; and FIDO2 combines WebAuthn with CTAP. Time-based one-time passwords (TOTP, RFC 6238) generate 6-digit codes from authenticator apps, while counter-based HOTP is less common. Federated identity and single sign-on (SSO) extend this further: SAML is an XML-based SSO standard, OAuth 2.0 is an authorization framework that lets apps obtain limited access without sharing passwords, and OpenID Connect is an identity layer on top of OAuth 2.0 that adds authentication and ID tokens. JSON Web Tokens (JWT) are a compact, URL-safe token format with a Header.Payload.Signature structure of three base64url-encoded parts used throughout these systems.
Once identity is established, access models determine permissions. Role-Based Access Control (RBAC) assigns permissions to roles and assigns users to those roles, simplifying administration. Attribute-Based Access Control (ABAC) makes decisions based on attributes of the user, resource, action, and environment, allowing fine-grained, context-aware policy enforcement. Strong passwords are long, unique, and unpredictable; length matters more than complexity because each additional character exponentially increases the number of combinations an attacker must try. Users should never reuse passwords because a single breached site enables credential stuffing, where stolen username/password combinations are automatically tried on thousands of other services. A password manager generates and stores unique strong passwords for every account, encrypted behind one master password, eliminating reuse and the need to memorize complex strings. Sessions represent server-side state for a logged-in user, referenced by a session ID in a cookie; defenses against session fixation (rotate the session ID on login) and session hijacking (protect the session ID with the Secure and HttpOnly attributes) round out identity hygiene.