Security · Who is asking, and may they

Authentication and authorization-style app

Illustrative system design for a who is asking, and may they app like Authentication and authorization: 4 topics to read, from requirements to deep dives.

Illustrative design, not Authentication and authorization’s actual implementation. Arrowbox is not affiliated with Authentication and authorization’s owner. Disclaimer

Start with Sessions and tokens Sign in to start readingUpdated 2 Oct 2026

Core

Where the session livesBeginner · 27 min read · Sign in to read
After login the browser must present a credential on every request; whether it is a server session behind an HttpOnly cookie, a bearer token the script attaches, or a cookie to a backend-for-frontend decides which attacks can steal or ride it.
Keeping a session aliveIntermediate · 38 min read · Sign in to read
Short-lived access tokens limit the damage of a leak, so the client needs a refresh path that is silent, happens once when many requests fail together, stays consistent across tabs, and ends cleanly on logout or revocation.
Signing in through another providerIntermediate · 40 min read · Sign in to read
'Sign in with Ferncloud' is the OAuth 2.0 authorization code flow plus OpenID Connect's ID token; PKCE, state and nonce are what make it safe in a browser that cannot keep a secret.
What the user may doIntermediate · 29 min read · Sign in to read
The server decides every permission; the client's job is to reflect those decisions honestly, react to 401 and 403 correctly, and never leak one account's data into another's view.