Q:

where is authentication happening in web3js?

When using web3 js to connect to ethereum private network, I just configured the http provider of the web3 instance to connect to the node.
how is just info about RPC endpoint sufficient to be able to connect to a node.
shouldn't there be some user authentication in place? because with just a RPC endpoint we were able to do what ever we want with the blockchain?
Is it just like that ? or am I missing some thing here?

A:

By default, the RPC interface does not expose the personal API, and so you cannot unlock accounts over it, so people cannot just send transactions from your accounts. In general, though, it is best practice to store keys locally, on the client side (in the browser, for instance), and then send pre-signed transactions over the RPC interface. 
That's not to say that authentication is a bad idea- publicly exposed RPC interfaces can be an easy DOS vector, and if you do unlock accounts, you don't want people sending from them.
That's why best practice is to have the client listen only to localhost, and use the CORS protection so that requests can only come from a single domain. You can set this by starting geth with the 
--rpccorsdomain "myDomain.com" flag. 

