Sobes.tech
Interview Help
Resources
Interview Preparation
Resources
Job Search
Resources
Legal
Back to questions
Junior

How does the authorization process work in the system?

sobes.tech AI

Answer from AI

The authorization process may include several steps, depending on the system implementation. A typical flow:

  1. Credential request: The user provides a login and password or other identification data (e.g., token, Public Key Infrastructure certificate).
  2. Authentication check: The system compares the provided credentials with data stored in a database or other secure storage.
    • Password comparison usually occurs after hashing the entered password to avoid storing and processing plain passwords.
    • For tokens or certificates, validation is performed according to the established protocol.
  3. Session/token issuance: Upon successful verification, the system generates a unique session identifier or access token and sends it to the client. This identifier or token is used for user authentication in subsequent requests, avoiding re-entry of credentials.
  4. Security context creation: The server creates a context related to the session or token, which may contain information about the user and their access rights.
  5. Redirection/access: The user is redirected to the requested page or gains access to protected resources.
  6. Session/token lifecycle: The session or token has a limited lifespan. After expiration, the user must re-authenticate (or use a token refresh mechanism).

Example of password verification (pseudocode):

# Assume we have a hashing function
def hash_password(password, salt):
    # ... hashing implementation (e.g., bcrypt)
    pass

# Assume we have a function to compare hashes
def verify_password(password, hashed_password, salt):
    # ... comparison implementation (comparing the hash of the entered password with the stored one)
    pass

# During authorization:
provided_password = user_input_password
stored_hash = get_hash_from_database(user_login)
stored_salt = get_salt_from_database(user_login)

if verify_password(provided_password, stored_hash, stored_salt):
    # Successful authorization
    create_session_and_redirect(user_login)
else:
    # Failed authorization
    display_error_message("Invalid login or password")

Authorization mechanisms:

  • Session-based authorization: The server maintains session state, and a Session ID (usually in a cookie) is issued to the client.
  • Token-based authorization: The server does not store session state (Stateless), and the client sends a token (e.g., JWT) with each request. The token contains information about the user and their rights.

Factors influencing the process:

  • Protocol used (HTTP, OAuth 2.0, OpenID Connect).
  • Presence of two-factor authentication (2FA) or multi-factor authentication (MFA).
  • Security requirements.
  • System architecture (monolithic, microservices).
PreviousNext