Authentication vs Authorization
Authentication answers the question 'Who are you?' Authorization answers 'What are you allowed to do?'.
A secure API commonly authenticates a user and then checks whether that identity has permission to perform a particular operation. These concerns should be modeled separately even when implemented within the same middleware pipeline.
Authentication and Authorization
Key Takeaways
- Authentication establishes identity.
- Authorization determines permissions.
- A valid identity does not automatically have access to every resource.
Knowledge Check
Which concept determines whether an authenticated user may perform an operation?