Authentication vs Authorization
Authentication and authorization are two different security concepts.
Authentication determines who the user is.
For example, a user enters an email and password. The backend verifies those credentials and establishes an authenticated identity.
Authorization determines what the authenticated user is allowed to do.
For example:
- A normal user can view their own profile.
- An administrator can view all users.
- An administrator can delete accounts.
A user may be authenticated but still not have permission to perform a particular operation.
Our application will implement JWT authentication and role-based authorization.
Authentication vs Authorization
| Feature | Authentication | Authorization |
|---|---|---|
| Purpose | Verify identity | Verify permissions |
| Example | User login | Admin-only endpoint |
| When | Before granting authenticated access | After identity is established |
| Failure | 401 Unauthorized | 403 Forbidden |
Key Takeaways
Authentication verifies identity.
Authorization checks permissions.
A valid login does not automatically grant administrative access.