Authentication and authorization

Authentication answers who a caller is. Authorization answers what that identity is allowed to do.

• Hash passwords with a modern password hashing algorithm.
• Expire and rotate credentials appropriately.
• Validate authorization on the server for every privileged action.
• Do not treat a user-controlled role field as proof of privilege.