The Runtime Theory

topic / identity-and-sessions

Identity and Sessions

Separate authentication, authorization, credentials, and session state.

Understand password verification, cookies, sessions, tokens, OAuth and OpenID Connect boundaries, authorization checks, expiry, and revocation.

1 article · 1 video · 1 trace · 1 request flow · 1 interview · 5 total

Articles

identity and sessionsSep 25, 2026

Authentication, Sessions, and Authorization

Authentication answers who or what is making a request; authorization decides which actions that identity may perform on a resource.

Request Flows

request flow · 5 stagesHow Authentication, Sessions, and Authorization worksAn interactive concept flow for authentication, sessions, and authorization, from its assumptions through the main operation and boundary checks.

Videos

identity and sessionsSep 25, 2026

Video lesson: Authentication, Sessions, and Authorization

Recording brief and narration plan for a visual lesson on authentication, sessions, and authorization.

Traces

trace 01 · serverTrace: Authentication, Sessions, and AuthorizationFollow the key state changes and boundary checks involved in authentication, sessions, and authorization.

Interviews

medium · t2Explain Authentication, Sessions, and AuthorizationExplain the model, execution steps, complexity, and limits of authentication, sessions, and authorization.

Explore adjacent

backend engineering

New lessons by email

Get new explanations about identity and sessions and related systems in your inbox.

One technical dispatch per week. No noise.