User Authentication Database

Introduction

Auth schemas store users, passwords (hashed!), sessions, tokens, MFA. Get this wrong and you're in the news.

Understanding the topic

Core concepts to understand:

• Hash passwords with bcrypt/argon2 — never plaintext.
• Sessions or JWTs — table for sessions if used.
• MFA secrets encrypted at rest.
• Audit login attempts.
• Rate-limit at the app and DB layer.

Syntax reference

Visual workflow / architecture:

users(id, email, password_hash, mfa_secret_enc, status)
sessions(id, user_id, expires_at, ip, ua)
login_audit(id, user_id, success, ip, ts)

Real-world use

Auth0, Clerk, Supabase Auth — all use this skeleton plus their own bells and whistles.

Best practices

• Argon2id for passwords.
• Encrypt MFA secrets at rest.
• Audit + alert on suspicious logins.

Hands-on exercise

Interview preparation — practice these questions:

• Q1. Password hashing algorithm choice.
• Q2. Session table vs JWT.
• Q3. MFA storage.
• Q4. Rate-limiting in DB.
• Q5. Login audit fields.