Every app that holds personal data or money needs to know who is making a request and what they are allowed to do. Mistakes here are among the most serious a backend developer can make, which is why adverts list security and data protection, and why broken access control sits at the top of well known security risk lists.
Two different questions
- Authentication asks "who are you?" It is signing in.
- Authorisation asks "are you allowed to do this?" It is checking permissions.
A user can be fully signed in and still not be allowed to see someone else's order. Many real breaches come from checking the first question and forgetting the second.
Passwords, done properly
If you store passwords, never store them as plain text. Store a hash made with a slow, purpose built algorithm such as bcrypt or Argon2, which your language has libraries for. When someone signs in, hash what they typed and compare. If your database ever leaks, attackers get hashes, not passwords.
Phone number and one time code
Many Ghanaian apps sign people in with a phone number, because phone numbers are widely used and not everyone uses email. The flow: