Authentication
Noun · Security & Infosec
Definitions
Authentication is the process of verifying that a user, device, or system is genuinely who or what it claims to be, answering the question 'Who are you?' Methods range from simple username and password combinations to multi-factor authentication (MFA), which layers something you know (password), something you have (phone, hardware key), and something you are (fingerprint, face). Modern implementations use protocols like OAuth 2.0 and OpenID Connect for delegated login, JWTs for stateless session management, and passkeys/WebAuthn for passwordless flows. Authentication is distinct from authorization: authentication establishes identity, while authorization determines permissions. Getting it wrong exposes systems to credential stuffing, session hijacking, and identity spoofing.
In plain English: Proving your identity to a system, like entering a password or scanning your fingerprint to log in.
Example: "We added FIDO2 hardware-key authentication so even a stolen password is not enough to log in."
Related Terms
- OTP
- OAuth 2.0 Flow
- CORS Preflight
- Service Account
- JWT Claims
- DAST
- Threat Modeling
- Anti-Forensics
- Anti-Malware
- Authentication Bypass
- Bluetooth Sniffing
- Business Email Compromise
- CAPTCHA Bypass
- Cookie Poisoning
- Credential Harvesting
- Credential Replay
- Device Fingerprinting
- Domain Hijacking
- Email Bombing
- HTTP Parameter Pollution
- HTTP Request Smuggling
- HTTP Response Splitting
- HTTPS Stripping
- ICMP Tunneling
- Identity Federation
- IDS Evasion
- Implicit Grant
- Information Security
- JSON Web Signature
- Log Forging
- Log Tampering
- Multi-Factor Authentication Bypass
- OAuth Token Theft
- Open Redirect
- Out-of-Band Verification
- Password Policy
- Permission Boundary
- Principal
- Privilege Boundary
- Privileged Access Management
- SAML
- Service Principal
- Trust Anchor
- Zero Trust Architecture
- Zero Trust Network Access
- Authorization Code
- Authorization Server
- Blockchain Security
- Claims-Based Identity
- Cloud IAM
- Code Flow
- Cross-Forest Attack
- Derived Credential
- Domain Controller
- Domain Trust
- Identity Governance
- Just-in-Time Provisioning
- Machine Identity
- Privileged Identity
- Role Mapping