# overview

Jobjakt supports local email/password sessions plus optional Google and Microsoft identity exchange.
Local access tokens are stored in an HttpOnly `jobtracker_session` cookie; mutating cookie-authenticated
requests also require the double-submit CSRF token. Identity, sessions, two-factor authentication,
trusted devices, email verification, and password reset are implemented by the controllers and services
under `JobTrackerApi/Controllers` and `JobTrackerApi/Services`.

Production authentication fails closed when required configuration is missing. See
`docs/architecture/authentication.md` and `docs/security/authentication.md` for the security model.