Cybersecurity glossary
What is Authentication?
Learn what authentication is, how identity proofs work across passwords, MFA, and federation, common failure modes that enable account takeover, and practical controls for secure login design.
Definition
Authentication is the process of verifying that a claimed identity is genuine by validating one or more authenticators—such as passwords, cryptographic keys, biometrics, or federation assertions—before granting a session or access token.
Why authentication sits at the center of security
Every protected action starts with a question: is this requester the identity they claim? Authentication answers that question. If the answer is wrong—or easy to forge—authorization, audit logs, and encryption around the session are built on sand.
Modern products authenticate people, devices, workloads, and service accounts. The mechanisms differ, but the goal is the same: establish enough assurance that subsequent access decisions are meaningful.
How authentication works in practice
Claim an identity
The subject presents an identifier such as a username, email, device ID, or federated subject.
Present authenticators
One or more proofs are supplied—password, OTP, passkey assertion, certificate, or IdP token.
Validate the proof
The verifier checks secrets, signatures, risk signals, replay windows, and policy requirements.
Establish a session or token
On success, the system issues a session cookie, access token, or assertion for later use.
Maintain and revoke
Sessions expire, rotate, and can be invalidated when risk rises or credentials change.
Common authenticator families
Knowledge factors
Passwords and PINs remain widespread but are vulnerable to phishing, stuffing, and reuse.
Possession factors
OTP apps, push devices, hardware keys, and smart cards prove control of a registered authenticator.
Inherence factors
Biometrics usually unlock a local credential rather than serving as a network-shared secret.
Federated proofs
SAML assertions and OIDC ID tokens let applications trust an upstream identity provider.
Cryptographic keys
Passkeys, client certificates, and workload identities authenticate with signatures instead of reusable secrets.
Risk signals
Device posture, location, velocity, and behavior can raise required assurance for sensitive actions.
Authentication vs authorization
| Topic | Core question | Example |
|---|---|---|
| Authentication | Who are you? | User proves possession of a registered passkey. |
| Authorization | What may you do? | Policy allows that user to read invoices but not delete them. |
| Accounting / audit | What did you do? | Logs record login success, MFA method, and resource access. |
| Session management | Is the proof still valid? | Short-lived tokens rotate; logout revokes active sessions. |
Failure modes that unlock accounts
Authentication fails when proofs are weak, reusable, or inconsistently enforced.
- Credential attacks — stuffing, spraying, and guessing succeed without rate limits or breached-password checks.
- Phishing and proxy kits — users type passwords or OTP codes into lookalike sites.
- Session theft — XSS, malware, or insecure cookies steal post-login state.
- Recovery abuse — reset links, backup codes, and help-desk flows become alternate front doors.
- Uneven clients — a hardened website sits next to a weak mobile or partner API login.
Controls that raise assurance
- Prefer phishing-resistant authenticators (passkeys, FIDO2 security keys) for admins and high-risk users.
- Enforce MFA consistently across web, mobile, APIs, and break-glass procedures with strong oversight.
- Rate-limit and monitor login, OTP, and recovery endpoints; return uniform error messages where possible.
- Hash passwords with a modern adaptive algorithm; never store reversible login secrets.
- Rotate session identifiers after authentication and invalidate them on logout, password change, and recovery.
- Harden password reset and MFA recovery; treat them as privileged authentication paths.
- Validate federation assertions strictly: issuer, audience, signature, nonce/state, and clock skew.
- Capture enough auth telemetry to investigate takeover without logging secrets or full recovery tokens.
Designing authentication as a product surface
Treat identity flows as first-class features: registration, login, step-up challenges, device binding, federation callbacks, and account recovery. Each path needs the same threat modeling you would apply to payment or admin APIs.
When assurance must increase—for example before changing billing or exporting data—use step-up authentication rather than relying on a long-lived low-assurance session.
The practical takeaway
Authentication is the act of proving identity with enough confidence for the risk at hand. Passwords alone rarely provide that confidence on the open internet.
Choose authenticators that resist phishing and replay, protect the full lifecycle from login through recovery, and keep authorization decisions tied to a trustworthy identity proof.
Related security terms
Authorization
Decides what an authenticated identity is allowed to do.
Multi-Factor Authentication (MFA)
Requires multiple independent factors to strengthen authentication.
Broken Authentication
Design and implementation flaws that let attackers impersonate users.
Single Sign-On (SSO)
Centralized authentication reused across many applications.
OAuth 2.0
Authorization framework often paired with OpenID Connect for login.
Frequently asked questions
What is authentication in simple terms?
Authentication is how a system checks that you are who you claim to be—usually by verifying a password, a security key, a one-time code, a biometric unlock, or a trusted identity provider assertion.
What is the difference between authentication and authorization?
Authentication verifies identity. Authorization decides permissions after identity is known. You authenticate first, then authorization controls which resources and actions are allowed.
What are common authentication methods?
Passwords, one-time passwords, push approvals, hardware security keys, passkeys/WebAuthn, certificates, biometrics unlocking device credentials, and federated login via SAML or OpenID Connect.
Why is password-only authentication risky?
Passwords are phished, reused, guessed, and leaked in breaches. Without a second factor or phishing-resistant authenticator, stolen credentials often equal account takeover.
What makes authentication phishing-resistant?
Cryptographic authenticators such as FIDO2/WebAuthn passkeys and security keys bind the proof to the legitimate origin, so fake login pages cannot easily steal a reusable secret.
Where does authentication usually fail in applications?
Weak login APIs, missing rate limits, fragile password reset, inconsistent MFA enforcement across clients, poor session handling after login, and insecure recovery or help-desk overrides.
How should teams design secure authentication?
Prefer phishing-resistant MFA for privileged access, protect credentials and sessions, unify policy across web and APIs, harden recovery, monitor abuse, and align with NIST and OWASP guidance.
References
Explore authoritative guidance and frameworks related to authentication.
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.