Authentication
Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
Secure APIs
Authentication is the process of verifying the identity of a user, service, or other entity requesting access.
- How it is used
- Uses identity verification as the first API-security gate before applying resource and operation access controls.
- How deep it goes
- Explains credentials, tokens, attack patterns, validation failures, and automated tests, while deferring detailed protocol implementation to named standards.
- Examples
- Illustrates login tokens, credential stuffing, unsigned tokens, internal APIs, protected lessons, student registrations, and admin endpoints.
- What you can do after
- Diagnose broken authentication with missing, malformed, expired, and tampered-token tests across protected API endpoints.
Authorization in Action
An authentication mechanism is a method or procedure for verifying the identity of an entity attempting to log in.
- How it is used
- Establishes a trustworthy requester identity before authorization evaluates access.
- How deep it goes
- Explains lifecycle, enrollment, factors, methods, threat tradeoffs, and authorization context without detailing protocol implementation.
- Examples
- Uses credential-phishing account takeover, self-service and administrative enrollment, and method comparisons from passwords through PKI.
- What you can do after
- Evaluate/understand authentication methods by assurance, usability, and resistance to phishing, replay, and credential theft.
Software Security for Developers
Message authentication is the process by which a recipient verifies the identity of the party that sent a message.
- How it is used
- Deploys authentication at user, message, and service trust boundaries to prevent impersonation and support secure application communication.
- How deep it goes
- Explains definitions, failure modes, protocols, tokens, HMAC, and service mechanisms, while deferring cryptographic proofs and protocol internals.
- Examples
- Uses login forms, SSO users, payment APIs, HMAC-protected files, spoofed service headers, certificates, JWTs, and request signatures.
- What you can do after
- Design secure authentication with SSO, OAuth2, OIDC, WebAuthn, HMAC, service tokens, certificates, or request signatures.
Read how Software Security for Developers explains authentication →
ASP.NET Core in Action, 3e
Authentication is the process of determining the identity of the subject that made a request.
- How it is used
- Identifies the user making each request so an app can personalize behavior and then decide what that user may do.
- How deep it goes
- Works through sign-in, principals, encrypted cookies, middleware, and Identity services; treats API authentication separately from the traditional web-app flow.
- Examples
- Traces a Razor Page login form and returning cookie-bearing request, then contrasts a single web app with apps sharing APIs.
- What you can do after
- Apply it via ASP.NET Core Identity and authentication middleware to sign users in and recognize them on subsequent requests.
Read how ASP.NET Core in Action, 3e explains authentication →
Effective Platform Engineering
Authentication is the process of verifying the identity of a user, service, or automated process.
- How it is used
- Provides a consistent sign-in path for developers accessing SaaS tools, platform infrastructure, and custom APIs.
- How deep it goes
- Works through an identity-provider and team-lookup flow, but defers detailed identity-provider configuration and implementation options.
- Examples
- Uses GitHub sign-in and teams, CircleCI permission integration, and an OIDC connection to a control plane.
- What you can do after
- Apply it via an OIDC integration and team-based authorization to reduce separate access requests across platform resources.
Read how Effective Platform Engineering explains authentication →
Acing the CCNA Exam: Volume 2 Advanced Networking and Security
An authentication message is a message exchanged to prove or verify the identity of a communicating entity.
- How it is used
- Controls access by verifying identities before granting permissions to networks, files, devices, or APIs.
- How deep it goes
- Defines identity verification and compares practical methods, commands, security levels, limitations, and verification output.
- Examples
- Uses FTP credentials, SNMPv3 users and groups, REST bearer tokens, API keys, and OAuth 2.0 access delegation.
- What you can do after
- Evaluate authentication methods and configure or troubleshoot credential-based access in Cisco IOS, SNMPv3, FTP, and REST API scenarios.
Read how Acing the CCNA Exam: Volume 2 Advanced Networking and Security explains authentication →
Build AI-Enhanced Web Apps
The process of verifying the identity of a user, application, or other requesting entity.
- How it is used
- Controls entry to public AI features so applications can protect user data and manage costly API usage.
- How deep it goes
- Defines authentication against authorization, compares sign-in methods, and walks through Clerk setup, middleware protection, redirects, and quotas.
- Examples
- Shows a protected Next.js chat route, sign-in redirects, a daily message quota, and sign-in for interview and RAG applications.
- What you can do after
- Apply it via Clerk.js to require sign-in for Next.js AI features and pair protected routes with usage limits.
Read how Build AI-Enhanced Web Apps explains authentication →
Building Web APIs with ASP.NET Core
Authentication is the process of verifying the identity of an API caller or other entity.
- How it is used
- Identifies callers before access decisions protect data-changing board-game API endpoints.
- How deep it goes
- Defines identity verification and walks through its access-control flow; stops short of showing authentication configuration or code in the supplied excerpts.
- Examples
- Uses login, fingerprint unlocking, and unrestricted board-game API write endpoints to make identity checks concrete.
- What you can do after
- Evaluate/understand when an API must identify callers and why identification alone does not grant permission.
Read how Building Web APIs with ASP.NET Core explains authentication →
The Well-Grounded Python Developer: How the pros use Python and Flask
An authentication system is software that verifies user or system identities during access to an application or service.
- How it is used
- Identifies users so a multiuser blog can reserve posting, commenting, and protected features for known users.
- How deep it goes
- Works through the login request sequence, session management, and password hashing, while leaving two-factor authentication as a stronger-security consideration.
- Examples
- Uses a multiuser blog’s email-and-password login flow and a navigation macro that switches between Login and Logout.
- What you can do after
- Build it from scratch with Flask login/logout routes, session management, hashed passwords, and user records.
Django in Action
Authentication is the process of verifying a user's identity before granting access to an API or other resource.
- How it is used
- Gates multiuser views and API endpoints by verifying a user or client before access.
- How deep it goes
- Explains account passwords, ORM users, session middleware, login redirects, reset flow, and API-key handlers; defers custom middleware.
- Examples
- Demonstrates RiffMates restricted_page with @login_required, a login template, password-reset screens, and an X-API-KEY handler.
- What you can do after
- Apply it via Django decorators, built-in auth URLs, templates, Django Ninja auth settings, and a custom API-key handler.
Pro ASP.NET Core 7, Tenth Edition
Authentication is the process of verifying the identity of a user or other security principal.
- How it is used
- Establishes user identity before ASP.NET Core authorization decides access to restricted application features.
- How deep it goes
- Works through credential submission, sign-in, cookies, redirects, and access tests; leaves broader Identity mechanisms outside the basic setup.
- Examples
- Tests login and logout URLs, cookie removal, role-based denial, and access to a Blazor entry page.
- What you can do after
- Apply it via ASP.NET Core Identity to sign users in, inspect cookie behavior, and distinguish failed authentication from denied access.
Read how Pro ASP.NET Core 7, Tenth Edition explains authentication →
Real-World Cryptography
A process for verifying the identity of a human user using credentials such as passwords or cryptographic keys.
- How it is used
- Secures adversarial protocols by verifying message authenticity or the identity of people and machines.
- How deep it goes
- Distinguishes message and identity authentication, then sketches user-login assumptions and password failure modes without detailing recovery.
- Examples
- Uses authenticated messages, HTTPS login, passwords, database breaches, cookies, TLS, Signal, and public key infrastructure as examples.
- What you can do after
- Evaluate authentication designs by separating message integrity from identity proof and spotting unsafe password storage or recovery assumptions.
Building Distributed Applications that Work
Authentication is the process of verifying the identity of a user or other principal.
- How it is used
- Controls who can place orders in a distributed online shop while leaving catalog browsing open.
- How deep it goes
- Explains the SSO redirect and token lifecycle, then details ASP.NET Core scheme registration and middleware without showing token validation internals.
- Examples
- Uses a Google-account sign-in analogy and an online-shop UI configured with cookie and OIDC schemes.
- What you can do after
- Operate/configure it in an ASP.NET Core UI using cookie authentication, an OIDC challenge, request middleware, and `[Authorize]`.
Read how Building Distributed Applications that Work explains authentication →
Quarkus in Action
Authentication is the process of verifying the identity of a user or other communicating principal.
- How it is used
- Secures an HTML frontend and the Users and Reservation services so a visitor can be identified rather than treated as anonymous.
- How deep it goes
- Shows development setup and HTTP authentication properties, but stops short of explaining authentication internals or a production Keycloak setup.
- Examples
- Uses a WhoAmI page, a Keycloak login screen, signed-in greetings, and Users service configuration properties.
- What you can do after
- Operate/configure it in development by requiring authentication for the Users service and sharing a Dev Services Keycloak instance across applications.
Kubernetes for Developers
Authentication is the process of verifying or presenting an identity to obtain credentials for accessing a system.
- How it is used
- Separates obtaining Kubernetes credentials from granting permissions to use them.
- How deep it goes
- Defines authentication and contrasts it with authorization, stopping short of explaining credential protocol internals.
- Examples
- Uses GKE credentials, a Google user account, namespace Roles, and Forbidden kubectl commands.
- What you can do after
- Operate kubectl with platform-issued credentials and distinguish authentication failures from RBAC authorization failures.
Read how Kubernetes for Developers explains authentication →
Introduction to Generative AI, Second Edition
Authentication is the process of verifying the identity, origin, or integrity of a digital asset or information source.
- How it is used
- Frames content authentication as a broader response to synthetic media than post hoc detection alone.
- How deep it goes
- Explains detection limits and introduces watermarking, provenance, and layered responses without implementation details.
- Examples
- Uses invisible watermarks, provenance signals, platform flagging, and Community Notes as examples of authentication or verification mechanisms.
- What you can do after
- Evaluate synthetic-media verification by comparing detection with provenance, watermarking, policy, education, and collaborative review.
Read how Introduction to Generative AI, Second Edition explains authentication →
Apache Kafka in Action
Authentication is the process of verifying the identity of a user or system requesting access to a resource.
- How it is used
- Verifies Kafka client identity at connection setup so authorization can determine permitted actions.
- How deep it goes
- Explains session persistence, mutual TLS certificates, and principal mapping; names SASL as an alternative without detailing its mechanisms.
- Examples
- Uses a certificate Distinguished Name and a listener rule that extracts its Common Name as a Kafka principal.
- What you can do after
- Operate/configure it by choosing mutual TLS or SASL, mapping certificate principals, and revoking permissions after client compromise.
Amazon Web Services in Action, Third Edition: An in-depth guide to AWS
Authentication is the process of verifying the identity of a user, resource, or other entity requesting access.
- How it is used
- Secures AWS API access and managed-cache connections by verifying callers before applying authorization decisions.
- How deep it goes
- Explains users, roles, groups, policies, credentials, MFA, and cache authentication, but stops short of detailed policy syntax.
- Examples
- Uses AWS root and IAM users, CLI access keys, EC2 roles, MFA setup, and Redis token-based or RBAC authentication.
- What you can do after
- Operate/configure AWS identities, credentials, MFA, policies, and cache authentication boundaries.
ScyllaDB in Action
Authentication is the process of verifying an application or user's identity before granting access to a database or service.
- How it is used
- Secures ScyllaDB connections and limits database access to designated users and applications.
- How deep it goes
- Explains authenticator behavior, migration risks, replication requirements, configuration changes, restarts, roles, and driver credentials.
- Examples
- Uses AllowAllAuthenticator, PasswordAuthenticator, TransitionalAuthenticator, a reviews_api role, Docker configuration, and PlainTextAuthProvider.
- What you can do after
- Configure ScyllaDB authentication and connect an application through the Python driver with valid credentials.
Rust Servers, Services, and Apps
Authentication is the process of verifying the identity of a client or user before granting access to protected functionality.
- How it is used
- Authenticates tutors signing in to a Rust web application before directing successful users to its home page.
- How deep it goes
- Implements credential lookup and password verification, while leaving JWT mechanics and infrastructure security outside the demonstrated sign-in flow.
- Examples
- Uses a tutor sign-in form, local user records, Argon2 password checks, and tests with correct and incorrect credentials.
- What you can do after
- Apply it via Actix Web to handle tutor sign-in requests and distinguish successful credentials from failed attempts.
Read how Rust Servers, Services, and Apps explains authentication →
.NET MAUI in Action
Authentication is the process of verifying the identity of a user, application, or service before allowing access.
- How it is used
- Secures communication between a .NET MAUI client and cloud API while gating entry to the application.
- How deep it goes
- Defines a service abstraction, mocks success, wires UI state, and uses modal navigation; real authentication remains deferred.
- Examples
- Uses MauiStockTake's LoginPage, IAuthService, MockAuthService, startup modal navigation, and success or failure UI paths.
- What you can do after
- Build it from scratch by separating login behavior into a service, testing the UI with a mock, and controlling startup navigation.
Google Anthos in Action
Authentication is the process of verifying the identity of a user, service, or other system actor.
- How it is used
- Governs access to managed clusters and establishes trusted identities for service-to-service communication.
- How deep it goes
- Descends from identity verification to provider choices, certificate configuration, token rotation, and layered request validation.
- Examples
- Uses KSA tokens, basic authentication, OIDC, Google Cloud Identity, workload certificates, and layered Connect request validation.
- What you can do after
- Operate/configure cluster access with IAM, OIDC, KSA tokens, certificate authorities, and secure rotation or distribution practices.
Kafka for Architects
Authentication is the process of verifying the identity of a user, service, or client.
- How it is used
- Uses identity verification as one layer of an enterprise Kafka security strategy alongside authorization and encryption.
- How deep it goes
- Explains the purpose, participants, mechanisms, configuration posture, and deployment trade-offs without providing detailed setup instructions.
- Examples
- Uses a Customer 360 ODS, mTLS client traffic, SASL_PLAINTEXT internal traffic, certificates, network segmentation, and Kafka component communication paths.
- What you can do after
- Operate/configure Kafka authentication by selecting mechanisms, securing communication paths, issuing certificates, and aligning network and security policies.
API Design Patterns
Authentication is the process of verifying a claimed identity using evidence such as a credential or cryptographic proof.
- How it is used
- Secures inbound API requests by verifying their claimed user, content integrity, and accountability.
- How deep it goes
- Explains the keypair, registration, request fingerprint, signature metadata, and verification flow, stopping short of full server verification details.
- Examples
- Uses public-key account registration and a signed PATCH request for updating chat room 1.
- What you can do after
- Apply request authentication by registering public keys and signing HTTP requests with verifiable fingerprints.
Azure Security
Authentication is the process of verifying that an identity belongs to the person, application, or entity claiming it.
- How it is used
- Secures Azure users and applications by verifying identity before resources grant access.
- How deep it goes
- Explains principals, resources, credentials, tokens, basic authentication, modern authentication, and MFA without detailing protocol internals.
- Examples
- Uses an airport identity check, web-application access, Azure AD sign-in, and user, application, and managed identities.
- What you can do after
- Evaluate/understand how credentials establish identity, tokens represent successful authentication, and MFA mitigates credential disclosure.
Terraform in Depth: Infrastructure as Code with Terraform and OpenTofu
Authentication is the process of verifying the identity of a user, system, or service before granting access.
- How it is used
- Supports Terraform access to remote state and cloud services, including automated deployment runs.
- How deep it goes
- Explains credential-delivery choices and walks through OIDC identity mapping and role assumption; leaves backend-specific details to backend documentation.
- Examples
- Uses AWS OIDC provider registration and a GitHub Actions workflow that assumes an AWS role.
- What you can do after
- Operate/configure it by selecting backend credential delivery and setting up a restricted OIDC trust relationship for deployment.
Data-Driven Cybersecurity
A system that verifies an entity's identity before granting access to a resource or service.
- How it is used
- Verifies users, services, and hardware before access, supporting identity governance and protection of organizational assets.
- How deep it goes
- Explains mechanism types, attack weaknesses, layered authentication, and operational metrics without presenting implementation code or configuration procedures.
- Examples
- Uses weak reused passwords, token codes, API-call verification, MAC addresses, TPM chips, and authentication success or failure metrics.
- What you can do after
- Evaluate authentication choices and performance using mechanism trade-offs, identity-related incidents, access timing, and anomaly-response measures.
Read how Data-Driven Cybersecurity explains authentication →
Spring in Action, Sixth Edition
Authentication is a Spring Security object that represents an authentication request or the resulting authenticated identity and authorities.
- How it is used
- Uses the authenticated identity to associate application data, such as TacoOrder, with the current User.
- How deep it goes
- Explains controller access patterns and principal retrieval, but stops short of authentication-provider or protocol internals.
- Examples
- Demonstrates TacoOrder persistence, controller method parameters, generated login credentials, and Spring Security’s plain login page.
- What you can do after
- Apply it via Spring Security controller injection to retrieve the current User and attach that identity to domain data.
Read how Spring in Action, Sixth Edition explains authentication →
Build Python Web Apps with Streamlit
User authentication is the process of verifying a person's identity before granting access to an account or application resources.
- How it is used
- Secures account creation, login, logout, and private CRUD experiences in a multi-page application.
- How deep it goes
- Explains credential lookup, password-hash comparison, return values, and session state, while deferring advanced security.
- Examples
- Uses Haiku Haven signup and login pages, UserService methods, password fields, session flags, and visible success or error messages.
- What you can do after
- Build a basic authenticated Streamlit flow with UserService, hashed passwords, session state, and private user-specific records.
Read how Build Python Web Apps with Streamlit explains authentication →
Practical Automation with PowerShell: Effective scripting from the console to the cloud
Authentication is the process of verifying an identity before granting access to a system or service.
- How it is used
- Supports PowerShell automation across hybrid environments, remote hosts, and authenticated web APIs.
- How deep it goes
- Explains credential objects, SSH key pairs, host verification, and API request parameters, while deferring provider-specific authentication schemes.
- Examples
- Demonstrates SSH key setup, Invoke-Command remoting, and a geo.ipify request that writes location data to Word.
- What you can do after
- Apply it via PowerShell credentials, SSH keys, or API-key request bodies when automating authenticated connections.
Pro Angular 16
Authentication is the process of verifying the identity of a user or other entity requesting access to a system.
- How it is used
- Protects administration routes and supplies credentials and tokens for authenticated REST requests.
- How deep it goes
- Builds a working Angular flow through forms, services, JWT handling, and route guards, but defers persistent token storage.
- Examples
- Uses a SportsStore login form, admin and secret credentials, success and failure JSON responses, and an AuthGuard route.
- What you can do after
- Build it from scratch as an Angular authentication flow that logs in users, tracks tokens, redirects failures, and guards routes.
Acing the Certified Kubernetes Administrator Exam, Second Edition
Authentication is the process of verifying the identity of a user, workload, or system making a request.
- How it is used
- Secures Kubernetes API access by establishing the identity of users and workloads before RBAC evaluates their permissions.
- How deep it goes
- Explains certificate, token, and external-provider mechanisms, emphasizing X.509 users and Service Account tokens for pods.
- Examples
- Uses kubectl client certificates, kubeconfig, Service Account tokens, `kubectl get sa`, and certificate-token access diagrams.
- What you can do after
- Operate/configure Kubernetes API access with user certificates and Service Accounts, then relate authenticated identities to RBAC permissions.
Read how Acing the Certified Kubernetes Administrator Exam, Second Edition explains authentication →
Grokking Web Application Security
Authentication is the process of verifying the identity of a user or other entity.
- How it is used
- Protects login boundaries and gates potentially dangerous server actions to verified users.
- How deep it goes
- Contrasts password login with OAuth and OpenID Connect, then works through a Ruby provider callback without JWT internals.
- Examples
- Uses Hydra credential wordlists, Gmail-contact consent, Facebook OmniAuth sign-in, and authenticated link sharing.
- What you can do after
- Apply OAuth/OpenID Connect through identity-provider registration and an OmniAuth sign-in callback.
Read how Grokking Web Application Security explains authentication →
.NET in Action, Second Edition
Authentication is the process of verifying the identity of a user, service, or other principal.
- How it is used
- Protects web APIs by verifying request tokens before allowing authenticated users to access resources.
- How deep it goes
- Explains token-based configuration and middleware placement, while deferring account management and OpenID Connect’s broader history.
- Examples
- Uses JWT bearer service registration, authentication middleware, and an Authorize-protected catalog controller.
- What you can do after
- Operate/configure ASP.NET Core APIs to accept JWT bearer tokens and protect controllers with authorization.
Read how .NET in Action, Second Edition explains authentication →
Related concepts
- authorizationcontrasts with · Authorization is the determination and enforcement of rules governing which subjects may access resources or perform operations.
- aaa frameworkpart of · The AAA framework is an access-control model comprising authentication, authorization, and accounting for verifying identity, controlling access, and recording resource usage.
- API gatewayused by · An API gateway is an intermediary that provides an entry point for client requests to backend APIs or services and routes or otherwise mediates those requests.
- credentialuses · A credential is information or an artifact presented as evidence of an entity’s identity, qualifications, status, or authorization to access a system or resource.
- JSON Web Tokenuses · A JSON Web Token is a compact, URL-safe representation of claims encoded as a JSON object and protected by a digital signature, message authentication code, or encryption.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.