Day 45 — WEB + BACKEND ENGINEERING

![ ](https://dev-to-uploads.s3.us-east-2.amazonaws.com/uploads/articles/mo2drhikcb0nuo1tA login screen doesn't make an application secure. Backend authentication does.

Day 45 — WEB + BACKEND ENGINEERING
Topic: Backend Authentication

Authentication is the process of verifying who a user is before allowing access to protected resources.

Let's take a Flutter application with a Node.js/Express backend.

When a user logs in, here's what happens:

1. The Flutter app sends login credentials to the backend over HTTPS.
2. The backend validates the input.
3. It checks the user's credentials against securely stored password hashes.
4. If the credentials are valid, the backend issues an access token.
5. Flutter securely stores the token and uses it for protected API requests.

Example:

POST /api/auth/login

After successful authentication, the backend may return:

{
  "accessToken": "your-access-token",
  "expiresIn": 900
}

For protected endpoints, Flutter sends:

Authorization: Bearer <access-token>

The backend verifies the token before processing the request.

But authentication doesn't stop at login.

A production-ready authentication system should also handle:

• Password hashing using secure algorithms such as Argon2id or bcrypt.

• Access token expiration.

• Refresh token rotation and revocation.

• Secure token storage on mobile devices.

• Logout and session management.

• Login rate limiting and abuse prevention.

• Password reset and email verification.

• Proper authentication error handling.

One important distinction:

Authentication answers: "Who are you?"

Authorization answers: "What are you allowed to access?"

For example, a customer may be authenticated but shouldn't be allowed to access an admin dashboard or another customer's private orders.

That's why backend authorization checks are essential. Hiding buttons in Flutter is not security.

My approach is to keep authentication logic on the backend, protect every sensitive endpoint, and never trust the frontend alone.

A successful login is only the beginning. Real security means protecting the user's identity, sessions and data throughout the entire application.

💬 How do you handle authentication in your projects: JWT, Firebase Authentication or session-based authentication?

Follow AyeshaAppDev for practical Backend Engineering, Flutter Development, API Security and real-world Software Engineering insights.

AyeshaAppDev | Software Engineerxkh2.png)