Credential
A credential is information or an artifact presented as evidence of an entity’s identity, qualifications, status, or authorization to access a system or resource.
Rust Servers, Services, and Apps
User credentials are authentication information, such as a username and password, used to authenticate a user.
- How it is used
- Authenticates tutors through registration and sign-in, while separate database credentials enable the application's Postgres connection.
- How deep it goes
- Traces form submission, database storage, and sign-in verification; specifies password hashing without detailing its algorithm.
- Examples
- Uses a tutor registration form, a Rust User model, a Postgres user table, and a sign-in request flow.
- What you can do after
- Build it from scratch: collect tutor credentials, store hashed passwords locally, and check submitted credentials during sign-in.
Read how Rust Servers, Services, and Apps explains credential →
Software Security for Developers
A client credential is authentication material that identifies an OAuth client to an authorization server.
- How it is used
- Protects application secrets and authenticates applications during service-to-service communication.
- How deep it goes
- Explains storage risks, centralized management, rotation, and the client credentials flow, but only sketches framework configuration.
- Examples
- Uses configuration files, credential vaults, ACME payment requests, and simplified identity-provider client settings.
- What you can do after
- Apply via OAuth 2 client credentials when one service must authenticate to another without user involvement.
Read how Software Security for Developers explains credential →
Build Python Web Apps with Streamlit
A credential is authentication information, such as an access key identifier and secret key, that authorizes access to a service.
- How it is used
- Authenticates Streamlit applications to BigQuery and authorizes the EB CLI to operate as an AWS user.
- How deep it goes
- Explains creation, role assignment, key generation, format conversion, and secret storage, but does not detail credential rotation.
- Examples
- Uses a Google Cloud JSON service-account key, secrets.toml, st.secrets, and AWS CLI credential prompts.
- What you can do after
- Operate BigQuery connections and Elastic Beanstalk setup using service-account or AWS user credentials stored as configuration.
Read how Build Python Web Apps with Streamlit explains credential →
Terraform in Depth: Infrastructure as Code with Terraform and OpenTofu
A credential is information used to authenticate or authorize access to a system or resource.
- How it is used
- Enables deployment runners to authenticate with infrastructure providers while keeping sensitive values out of source control.
- How deep it goes
- Works through OIDC-based temporary credential setup for AWS deployments, but does not detail credential formats or the token exchange protocol.
- Examples
- Uses GitHub Actions assuming an AWS role and a Spacelift AWS provider reading a per-run OIDC token file.
- What you can do after
- Operate/configure OIDC-based provider authentication to obtain temporary deployment credentials instead of storing persistent credentials in Git.
Grokking Web Application Security
A credential is information, such as a username and password, used to authenticate a user.
- How it is used
- Frames credentials as account-access secrets that require protection against guessing, theft, and breach exposure.
- How deep it goes
- Defines username-and-password credentials and explains brute-force reuse and hashed storage without detailing broader authentication implementations.
- Examples
- Uses leaked username-password lists, database backups, source-control exposure, and a Ruby bcrypt hashing check.
- What you can do after
- Evaluate/understand why plain-text password storage and reused passwords magnify the impact of credential theft.
Read how Grokking Web Application Security explains credential →
Pro ASP.NET Core 7, Tenth Edition
An authentication credential is information, such as a username and password, presented to verify a user's identity.
- How it is used
- Establishes a user's identity before authorization grants access to application features.
- How deep it goes
- Defines username/password credentials and follows validation through sign-in, while deferring deeper Identity service mechanics.
- Examples
- Uses a SportsStore login form, LoginModel, AccountController, validation errors, redirects, and an administrative logout link.
- What you can do after
- Apply credentials through ASP.NET Core Identity to authenticate users and redirect successful logins.
Read how Pro ASP.NET Core 7, Tenth Edition explains credential →
Authorization in Action
A credential is information or an artifact presented as evidence of an entity's identity, qualifications, status, or authorization.
- How it is used
- Uses credentials to authenticate entities and support authorization decisions within managed identity relationships.
- How deep it goes
- Explains issuance, proofing, validity, revocation, signatures, and lifecycle risks, but does not detail credential formats or cryptographic algorithms.
- Examples
- Uses employee and contractor enrollment, digital certificates, biometrics, and an accredited auditor’s organizational and certification credentials.
- What you can do after
- Evaluate/understand credentials by checking their issuer, attributes, signature, validity, revocation status, and lifecycle freshness.
Related concepts
- authenticationused by · Authentication is the process of establishing or verifying the identity of a user, service, device, or other communicating entity.
- managed identityaddressed by · A managed identity is a nonhuman digital identity whose credentials and lifecycle are administered by a cloud or infrastructure service, allowing workloads to authenticate to supported resources without managing credentials directly.
- brute-force attackused by · A brute-force attack systematically tries numerous possible credentials, keys, inputs, or combinations until one succeeds or the search space is exhausted.
- public-private key pairincludes · A public-private key pair is a mathematically related public key and private key used together for asymmetric cryptographic operations.
- SignInManager<T>used by · SignInManager<T> is an ASP.NET Core Identity service that manages sign-in, sign-out, and related authentication operations for user accounts.
These guides are generated from the text of Manning books by Manning's knowledge graph and link to the sections they draw on. The full books are available on liveBook and at manning.com.