Topic 6B.6
Authentication: Sessions, JWT, OAuth 2.0, OIDC & SSO
In one line
Authentication answers 'who is calling?'. Sessions and tokens carry that answer between requests; OAuth 2.0 delegates access; OpenID Connect adds login on top; SSO lets one identity provider serve every app.
Think of it like this
A hotel. At check-in you prove who you are once (passport = password). You get a key card (session/token) that opens your room until checkout, without showing your passport every time. OAuth is giving a valet a car key that starts the car but can't open the boot: limited, delegated access. SSO is one wristband that works at every venue in the resort.
Key ideas
- 01
SESSIONS: after login, the server stores a session (in Redis/DB) and gives the browser a random ID in an HttpOnly, Secure cookie. Easy to revoke (delete the session), small cookie, but needs a shared session store. Best for classic web apps.
- 02
TOKENS (JWT): a signed, self-contained token carrying claims (
sub,roles,exp). Any service can verify the signature without a lookup, which suits APIs and microservices. But a JWT can't be revoked before it expires, so keep ACCESS tokens short-lived (5–15 min) and use REFRESH tokens (stored securely, revocable) to get new ones. Never put secrets in a JWT: it's signed, not encrypted. - 03
OAUTH 2.0 is for DELEGATED AUTHORIZATION: an app gets an access token to call an API on a user's behalf ('let this app read my calendar'). The AUTHORIZATION CODE FLOW WITH PKCE is the standard for web and mobile apps; CLIENT CREDENTIALS is for service-to-service calls with no user. OPENID CONNECT (OIDC) adds an ID token that says who the user is, turning OAuth into LOGIN ('Sign in with Google').
- 04
SSO: an IDENTITY PROVIDER (Okta, Entra ID, Keycloak, Auth0, Cognito) handles login once, with MFA, for all apps via OIDC or SAML. Apps never see passwords. In microservices, the API gateway validates tokens at the edge and services check scopes/claims (and, for zero trust, services authenticate each other with mTLS).
Java / Spring map
- →
Spring Security's
oauth2Login()implements the OIDC login flow for web apps;oauth2ResourceServer().jwt()validates bearer JWTs (signature via the provider's JWKS endpoint, expiry, issuer, audience) on APIs.
Code & diagrams
Explain without notes
Why are JWT access tokens kept short-lived?
What's the difference between OAuth 2.0 and OpenID Connect?
Practice
Design authentication for a shop with a web app, a mobile app, and 10 microservices behind an API gateway.
Trade-offs
- ↔
Sessions: easy revocation, stateful store. JWTs: stateless verification and scale, but revocation and size issues. Centralising identity in an IdP simplifies apps but makes the IdP critical infrastructure.
Run it in production
You've designed it. Now build, operate, and break the same idea hands-on in the DevOps courses:
Completion checklist
I can explain sessions vs JWTs and when to use each
I can describe the authorization code + PKCE flow
I know OAuth is authorization and OIDC is authentication