Authentication methods

1. Password-Based Authentication

Description:

User enters a username/email and password.

Pros:

• Simple and familiar

• Easy to implement

Cons:

• Weak passwords are easily guessed or brute-forced

• Susceptible to phishing

Best Practice:

• Use bcrypt/argon2 to hash passwords

• Enforce password policies

• Combine with MFA

  
  

2. Multi-Factor Authentication (MFA / 2FA)

Description:

Requires 2 or more of the following:

• Something you know (password)

• Something you have (phone, token)

• Something you are (biometrics)

Common Types:

• TOTP: Time-based One-Time Password (e.g., Google Authenticator)

• SMS code (less secure)

• Hardware token (YubiKey)

  
  

3. Social Login (OAuth2 / OpenID Connect)

Description:

Login using existing accounts from:

• Google

• Facebook

• GitHub

• Apple

Pros:

• Fast user onboarding

• Reduces password fatigue

Cons:

• Reliant on third-party providers

• Privacy implications

Tools:

• Auth0, Firebase Auth, Passport.js strategies

  
  

4. Biometrics

Description:

Use fingerprint, face recognition, or retina scan.

Pros:

• High security

• Fast and convenient

Cons:

• Requires hardware

• Privacy concerns

  
  

5. Magic Link / Email Link Login

Description:

User receives a secure login link in email.

Pros:

• No password needed

• Convenient for users

Cons:

• Depends on email security

• Slower than traditional login

  
  

6. Single Sign-On (SSO)

Description:

One login grants access to multiple apps (e.g., Google Workspace, SAML, Okta).

Pros:

• Great for enterprises

• Reduces password sprawl

Cons:

• Setup can be complex

• Central point of failure if not secured

  
  

7. Public Key Authentication

Description:

Mostly used in backend/dev ops (e.g., SSH). User authenticates using a key pair (private/public key).

Pros:

• Very secure if private key is protected

Cons:

• Not user-friendly for web apps

  
  

8. Passwordless Authentication

Description:

Login without password using:

• Biometrics

• Magic link

• FIDO2/WebAuthn (e.g., YubiKey, device biometrics)

Pros:

• Very secure

• Eliminates password-related risks

Cons:

• May need newer browsers/devices

9. API Token/Bearer Token (for APIs)

Description:

Used for machine-to-machine or sessionless auth.

• JWT (JSON Web Token)

• OAuth2 Bearer token

Pros:

• Stateless

• Easily used with frontend/backend APIs

Cons:

• Must be securely stored and rotated

Would you like code examples or implementation advice for any of these methods?