Some context - what is modern authentication?

 Back in the last century, businesses used to have these things called websites...

Well ok, we still have them, and many of them are still monolithic.

There's a front end - what the user sees - and there's a back end database with a bunch of tables all relating to something the user might experience:

Here we've got products, users, transactions (orders), chat, and sign-in credentials.

Now in a smarter world, these functions would be broken up and outsourced to specialist software products, and that's what modern authentication does with the sign in credentials.  It's not only safer, it also provides some nice functionality like being able to sign in across multiple different applications (single sign on - SSO).

The way this works is that when the user wants to (or is forced to) sign in, they're actually redirected to another website (called an Identity Provider or IdP).  The IdP handles the sign in, and returns a token back to the original application.  Because the token is signed an encrypted, and the web application has the secret required to decrypt it, the web application can safely assume that the user is signed in.

Modern IdPs such as Azure AD B2C also handle processes like password reset, so you don't need to code it into your website.  And provide a bunch of other features and benefits which we'll discuss in future posts.