Authentication vs Authorization
Authentication determines who the user is. Authorization determines what that user is allowed to do.
For example, a user can successfully authenticate as alice@example.com but still be unauthorized to access another user's invoice.
A robust application checks authorization at the server boundary where the protected resource is accessed. Hiding a navigation link is not authorization.
Request Security Flow
Key Takeaways
- Authentication identifies the principal.
- Authorization controls permissions.
- Authorization must be enforced server-side.