Authentication vs Authorization
Authentication answers "Who are you?" Authorization answers "What are you allowed to do?"
A secure backend enforces authorization on the server for every protected operation. Hiding UI controls is not authorization.
Request
|
v
Authenticate identity
|
v
Authorize action/resource
|
v
Business operation
Sessions, tokens, OAuth/OIDC, and API keys solve different problems. Choose based on system boundaries.
Key Takeaways
- Authentication and authorization are different concerns.
- Authorization must be enforced server-side.
- Use established protocols instead of custom authentication schemes.