JobCannon
全部技能

Authentication & Authorization (OAuth, JWT, SSO)

Secure user login & access control: who you are (authn) vs what you can do (authz)

⬢ 層級 3技術
中等
薪資影響
7 個月
學習時長
中等
難度
5
職業
一覽

Authentication (who you are) and authorization (what you can do) are non-negotiable for secure apps. Master OAuth 2.0, JWT, SAML, OIDC, RBAC/ABAC, and identity providers (Auth0, Clerk, WorkOS, Okta, Cognito). Career: L1 basics → L2 OAuth/SSO (6-9 months, +$25-40k) → L3 SAML/OIDC/custom flows (9+ months, +$30-40k). Industry standard: all L2+ backend roles require it.

什麼是 Authentication & Authorization (OAuth, JWT, SSO)

Authentication and authorization are the dual foundations of application security. Authentication answers "who are you?" (verifying identity via credentials, tokens, or passwordless methods), while authorization answers "what are you allowed to do?" (controlling access to resources based on roles, permissions, or attributes). In 2026, every production system must implement both: OAuth 2.0 or OIDC for user login, JWT or session tokens for stateless APIs, and RBAC/ABAC for access control. Teams that skip this or bolt it on late pay 3-6x the cost to retrofit. The landscape has shifted from password-only to passwordless-first: passkeys (WebAuthn), magic links, and SMS OTP dominate new implementations. Enterprise still demands SAML, but OIDC has become the standard for mid-market. The skill gap between "uses Auth0 or Clerk" and "can design multi-tenant auth with custom federation" translates directly to $30-40k salary premium.

🔧 工具與生態
Auth0ClerkWorkOSOktaSupabase AuthFirebase AuthKeycloakJWTPassport.jsNextAuthStytchCognito

💰 各地區薪資

地區初級中級高級
USA$100,000$145,000$190,000
UK£55,000£80,000£115,000
EU€60,000€85,000€125,000
CANADACA$105,000CA$150,000CA$200,000

🎯 使用 Authentication & Authorization (OAuth, JWT, SSO) 的職業

Backend Developer
Decentralized Identity Engineer
Frontend Developer
Open Banking Engineer
Product Manager

❓ 常見問題

OAuth 2.0 vs OpenID Connect, what's the difference?
OAuth 2.0 is delegation: gives apps permission to access your data (identity provider doesn't authenticate you). OpenID Connect (OIDC) layers authentication on top: proves who you are + provides an ID token with claims. Use OAuth for third-party API access. Use OIDC for user login (SSO). Enterprise SSO = OIDC + SAML hybrid.
Should I use Auth0/Clerk or build my own authentication?
Auth0/Clerk/WorkOS unless you have 50k+ users and specific compliance needs (HIPAA/PCI). Managed providers handle: password resets, MFA, bot detection, compliance audits, breach response, updates. Roll-your-own costs 3-6 engineers + $50k/year compliance. Clerk best for SaaS startups; Auth0 for enterprise; Okta for organizations with legacy systems.
JWT vs session cookies, when do I pick each?
Sessions (cookie + server-side store): simpler, session revocation instant, best for web browsers, vulnerable to CSRF (mitigate with SameSite). JWT: stateless, API-friendly, scales horizontally, can't revoke instantly (expiry window = vulnerability). Hybrid: use both, cookie with short-lived JWT refresh token for APIs, session for browsers.
RBAC vs ABAC, when does each make sense?
RBAC (Role-Based): user has role (admin/editor/viewer) → fixed permissions. Simple, fast, scales to 100s of roles. ABAC (Attribute-Based): rules evaluated per request (e.g., allow if owner=requester AND time<18:00). Flexible, auditable, slower. Start RBAC; add ABAC rules only when RBAC becomes unwieldy (>20 roles or complex approval workflows).
How do I store passwords securely?
NEVER store plaintext or use MD5/SHA1. Use bcrypt (12+ rounds), scrypt, or Argon2. Hash + salt at rest. Let OAuth/OIDC providers handle it. If you must: Argon2id (best, OWASP recommendation), bcrypt (proven, slower = harder to crack), PBKDF2 (acceptable, NIST-approved). Implement rate limiting on login attempts (5 tries in 15 min → lock 30 min).
How do I set up single sign-on (SSO) with SAML?
SAML 2.0 flow: user visits your app → redirected to enterprise IdP (Okta/Azure AD) → IdP authenticates → posts signed SAML assertion back to your app → app verifies signature + extracts claims (email, name, groups). Use `@node-saml/node-saml` or use Okta SDK. Enterprise loves SAML; never roll it yourself (signature validation = crypto gotchas).
Magic links vs passwords, should I ditch passwords?
Magic links (email or SMS OTP): no password to steal, mobile-friendly, passwordless phishing impossible. But email/SMS hijacking = still vulnerable. Best: passwordless default + password option as backup, or passkeys (WebAuthn) + magic link. Implementation: generate short token, email link with `?code=xyz`, verify token expires in 10-15 min, set session. Cost: ~$0.01/email via SendGrid.

不確定這項技能適不適合你？

做一下職業匹配，我們會推薦合適的方向。

找到最適合我的技能 →

找到理想的職業方向

在 2,521 個職業中進行技能匹配。免費。

免費做職業匹配 →