Session based authentication is at the root of the passport-local strategy. If we were to create a lineage for these authentication methods, session based authentication would be the oldest of them all, but certainly not obsolete. You can implement the OAuth protocol without using OAuth the company’s service! What is Session Based Authentication? This is a specific note made to highlight the fact that there is actually a company called “OAuth” that implements the OAuth protocol… As a service. Google, Facebook, Github, etc.).įinally, you might notice that OAuth is listed as “As a service” and “In house”. Not only is it unnecessary for a small team/startup getting an application off the ground, but it is also slightly different depending on which service you are using (i.e. One note I’ll make–Oauth can become confusing really quickly, and therefore is not fully explored in this post. In other words, this is federated authentication where an existing service (like Google) handles the authentication and storage of users while your application leverages this flow to authenticate users. OAuth and OpenID Connect Authentication - A modern authentication method where an application uses “claims” generated from other applications to authenticate its own users.This JWT has assertions about a user and can only be decoded using a secret that is stored on the server. JWT Authentication - A stateless authentication method where a JSON Web token (JWT) is stored in the browser (usually localStorage).Session-Based Authentication - Utilizes browser Cookies along with backend “Sessions” to manage logged-in and logged-out users.

Above is a high-level overview of the main authentication choices available to developers today.

Passport js