How is the authorization (web)?

Question

Sessions

Hello!
I don't fully understand how this happens. You can provide links to literature and articles, if you are interested in various authorization options: classic, by tokens, with a refresh token, etc.
I find articles, but they are in the how to mode, superficially or already for those who have seen the light, but are interested in detail, with a description of the mechanisms.
I worked on the site, found a script that was loaded through the "hole", it received from php.ini the addresses of the session, tmp folders, a bunch of other settings, which I changed. Then a script that merged the database. Of course, this is a blatant hack and no tokens and SMS authorization will save you from it. But, it made me think about the authorization process and its vulnerability.

Answer 1

Catch!!