Phase 8: Security
Explore the concepts of Security.
Authentication vs Authorization
Authentication (AuthN) and Authorization (AuthZ) are the foundational pillars of system security. They are distinct concepts that answer two different questions: "Who are you?" and "What are you allowed to do?" 🧠 Mental model: Authentication is checking a passenger's passport at airport security to verify their identity. Authorization is checking their boarding pass at the gate to ensure they are allowed to get on that specific flight.
OAuth2 & JWT
OAuth 2.0 is an authorization framework that lets a third-party application access a user's resources without knowing their password. JSON Web Tokens (JWT) are a compact, cryptographically signed format for transmitting those access claims securely between parties. Together, they form the backbone of modern API security. 🧠 Mental model: OAuth2 is the process of getting a valet key. You give the valet a special key that only opens the doors and starts the engine, but doesn't open the trunk or glovebox (scope). JWT is the physical valet key itself - it has a stamp on it (signature) proving it is authentic.
API Gateway
An API gateway is a single entry point that sits in front of backend services and routes each incoming request to the right service while handling cross-cutting concerns. Service discovery is the mechanism that lets callers find the current network location of those services as instances start, stop, and move. 🧠 Mental model: The API gateway is a hotel concierge - all guests (clients) talk to one person, who routes them to the right service (restaurant, spa, room service). Service discovery is the hotel directory that tells the concierge which services are open today.
Encryption (At Rest/In Transit)
Data security fundamentals cover how sensitive data is protected in its two basic states: while it moves across a network and while it sits in storage. Encryption in transit protects data on the wire while encryption at rest protects data on disk, and a secure system applies both. 🧠 Mental model: Encryption in transit is a sealed envelope - nobody can read the letter while it's being delivered. Encryption at rest is a locked safe - even if someone breaks into your house, they can't open the safe without the key.
DDoS Protection
A Distributed Denial of Service (DDoS) attack attempts to make an online service unavailable by overwhelming it with traffic from multiple sources. DDoS protection involves deploying network and application-level defenses to absorb, filter, and block malicious traffic while allowing legitimate users through. 🧠 Mental model: Imagine a thousand fake customers swarming a tiny coffee shop just to stand in line and order nothing, preventing real customers from getting coffee. DDoS protection is the bouncer at the door checking IDs and quickly turning away the fakes so the real line keeps moving.