Modern Authentication
11 Modules ~30 hours Beginner → Advanced
Master modern authentication patterns: JWT, OAuth 2.0, OpenID Connect, sessions, MFA, federation, passkeys. From "what is auth?" to building production-grade identity systems.
Course roadmap
| # | Module | Status | Topics |
|---|---|---|---|
| 0 | Setup & Auth Vocabulary | Plan ready | Authn vs Authz, identity, principal, factor, JWT vs session, threat model basics |
| 1 | Sessions & Cookies | Plan ready | Server-side sessions, cookie attributes (HttpOnly, Secure, SameSite), CSRF |
| 2 | Password Security | Plan ready | Bcrypt/Argon2, password policies, breach databases, account recovery |
| 3 | Multi-Factor Auth | Plan ready | TOTP, WebAuthn/passkeys, SMS pitfalls, recovery codes, backup factors |
| 4 | JWT Deep Dive | Plan ready | RS256 vs HS256, claims, expiry, refresh tokens, JWT pitfalls (none algo, kid injection) |
| 5 | OAuth 2.0 | Plan ready | Auth Code + PKCE, Client Credentials, Implicit (deprecated), token introspection |
| 6 | OpenID Connect | Plan ready | ID Token, UserInfo endpoint, discovery, single sign-on |
| 7 | Federation & SSO | Plan ready | SAML, social login, IdP integration, SCIM provisioning |
| 8 | Authorization | Plan ready | RBAC, ABAC, OPA / Cedar, fine-grained policies |
| 9 | Production Hardening | Plan ready | Rate limiting, brute-force, account lockout, leaked password detection |
| 10 | Capstone | Plan ready | Build a multi-tenant identity platform with passkeys + SSO + audit |
What's available now
This is a curriculum plan, not yet content. Module 0 will be available shortly.
In the meantime, see related courses already published:
- AWS Cloud Security — IAM, KMS, identity-based authorization
- aws-developer — Cognito on AWS
Why this curriculum
Authentication is the most-attacked surface in any app. This course mirrors industry-grade curricula (Auth0 Academy, OAuth.net) with hands-on labs in Node.js, Python, and Go.
Last updated
2026-05 — Curriculum plan published. Module 0 content arrives 2026 H2.