All Patterns USP's - sonuprajapati15/Authentication-Authorization GitHub Wiki

Comparison of Authentication & Authorization Models

This guide covers Token-Based Authentication, Session-Based Authentication, OAuth 2.0, SAML, MFA, RBAC, ABAC, and the Zero Trust Model with their pros, cons, limitations, and real-life examples.

1. Token-Based Authentication

What it is:

A stateless authentication method where users receive a token (JWT, OAuth) upon login, which they send with every API request.

Pros:

βœ… Scalable & Stateless β†’ No need to store session data on the server.
βœ… Works Across Multiple Services β†’ Suitable for microservices & cloud.
βœ… Fast Authentication β†’ Once a token is issued, no database lookups needed.

Cons & Limitations:

❌ Token Revocation is Hard β†’ If a token is stolen, it remains valid until expiration.
❌ Tokens Can Be Hijacked β†’ Must use secure storage (HTTP-only cookies, encryption).
❌ Short-Lived Access β†’ Requires refresh tokens for long sessions.

Real-Life Example:

πŸ”Ή Netflix, Spotify, and Twitter APIs – Uses JWT for API authentication.
πŸ”Ή GitHub API – Uses OAuth tokens instead of passwords for API requests.

2. Session-Based Authentication

What it is:

Traditional authentication method where a server stores session data and a session ID is sent via a secure cookie.

Pros:

βœ… More Secure Than Tokens β†’ Sessions can be revoked immediately.
βœ… Simpler to Implement β†’ Works well in monolithic web apps.
βœ… No Need for Token Storage β†’ Everything is managed server-side.

Cons & Limitations:

❌ Not Scalable β†’ Requires session storage (Redis, database).
❌ High Server Load β†’ Every request requires a session lookup.
❌ CSRF Vulnerabilities β†’ Must use CSRF protection techniques.

Real-Life Example:

πŸ”Ή Banking & E-commerce Websites β†’ Stores session in Redis or MySQL.
πŸ”Ή Facebook Before OAuth β†’ Used session-based authentication for web logins.

3. OAuth 2.0 Authentication

What it is:

A token-based authorization framework that allows third-party apps to access user data without sharing credentials.

Pros:

βœ… Ideal for API Security β†’ Users delegate access to apps.
βœ… Supports SSO & Mobile β†’ Works across different platforms.
βœ… Secure via Access & Refresh Tokens β†’ Uses short-lived tokens with refresh capability.

Cons & Limitations:

❌ Complex Implementation β†’ Requires OAuth provider (Google, Facebook, etc.).
❌ Scope Limitations β†’ Users must manually approve permissions for apps.
❌ Token Storage Security β†’ Improper storage can lead to leaks.

Real-Life Example:

πŸ”Ή Google OAuth Login – "Login with Google" for third-party apps.
πŸ”Ή Spotify API – Allows third-party apps to access your music library via OAuth.

4. SAML Authentication

What it is:

Security Assertion Markup Language (SAML) is an SSO authentication standard used for enterprise identity management.

Pros:

βœ… Enterprise-Grade Security β†’ Uses signed & encrypted assertions.
βœ… Best for SSO in Large Organizations β†’ Allows a single login for multiple systems.
βœ… Works Across Multiple Domains β†’ Unlike OAuth, SAML works without APIs.

Cons & Limitations:

❌ Not Ideal for APIs β†’ Uses XML, which is slower than JSON-based tokens.
❌ Complex Setup β†’ Requires Identity Provider (IdP) & Service Provider (SP).
❌ Not Mobile-Friendly β†’ Designed for web apps, not native mobile apps.

Real-Life Example:

πŸ”Ή Google Workspace (G Suite) SSO – Uses SAML for enterprise authentication.
πŸ”Ή AWS Identity Federation – Uses SAML for cloud access control.

5. Multi-Factor Authentication (MFA)

What it is:

An authentication method requiring two or more factors (password + OTP, fingerprint, security key).

Pros:

βœ… Increases Security β†’ Prevents password-only breaches.
βœ… Flexible Authentication Methods β†’ OTP, TOTP, SMS, Email, Biometric.
βœ… Mandatory for Compliance β†’ Required for GDPR, HIPAA, PCI-DSS.

Cons & Limitations:

❌ User Experience Impact β†’ Adds extra login steps.
❌ SMS-Based MFA is Weak β†’ Susceptible to SIM-swapping attacks.
❌ Hardware-Based MFA Can Be Costly β†’ Security keys require hardware purchase.

Real-Life Example:

πŸ”Ή Google Authenticator, Authy – TOTP-based MFA apps.
πŸ”Ή Apple ID, Microsoft Account MFA – Enforces MFA on sensitive accounts.

6. Role-Based Access Control (RBAC)

What it is:

Users are assigned roles (Admin, Editor, Viewer), and roles define permissions.

Pros:

βœ… Easy to Implement & Manage β†’ Fixed roles simplify user access management.
βœ… Enforces Least Privilege β†’ Users get only the access they need.
βœ… Works Well for Organizations β†’ Ideal for hierarchical access control.

Cons & Limitations:

❌ Not Flexible β†’ Users can’t have conditional access based on attributes.
❌ Role Explosion Problem β†’ Too many roles can lead to complexity.

Real-Life Example:

πŸ”Ή AWS IAM Roles – Manages cloud permissions using RBAC.
πŸ”Ή Enterprise HR & IT Systems – Assigns roles to employees.

7. Attribute-Based Access Control (ABAC)

What it is:

Access is controlled based on attributes (location, time, department, risk level) rather than just roles.

Pros:

βœ… More Flexible Than RBAC β†’ Can enforce dynamic policies.
βœ… Granular Access Control β†’ Allows context-aware security.
βœ… Best for Regulatory Compliance β†’ Used in GDPR & HIPAA security models.

Cons & Limitations:

❌ Complex Policy Management β†’ Requires attribute-based rules.
❌ Performance Issues β†’ Policy evaluation is slower than RBAC.

Real-Life Example:

πŸ”Ή Google Drive Sharing – Users can share files based on user attributes.
πŸ”Ή Healthcare Systems – Doctors can only access patient records in their department.

8. Zero Trust Security Model

What it is:

Assumes no entity is trusted by default, and every access request is continuously verified.

Pros:

βœ… Best Security Model β†’ Prevents insider threats & lateral movement attacks.
βœ… Continuous Authentication β†’ Uses behavior analytics.
βœ… Micro-Segmentation β†’ Restricts access to only what’s necessary.

Cons & Limitations:

❌ Complex & Costly β†’ Requires advanced security infrastructure.
❌ High Performance Overhead β†’ Every request must be authenticated.

Real-Life Example:

πŸ”Ή Google BeyondCorp – Implements Zero Trust for corporate access.
πŸ”Ή US Department of Defense (DoD) – Uses Zero Trust for cyber defense.

Final Thoughts

Each security model has strengths and trade-offs. The best approach is often a combination:
πŸ”Ή OAuth + MFA for API security
πŸ”Ή RBAC + ABAC for enterprise access control
πŸ”Ή Zero Trust for high-security organizations