Authentication vs Authorization
Authentication answers 'who are you?' Authorization answers 'what are you allowed to do?'
The browser may hide UI that a user cannot access, but the server must enforce permissions. Tokens, sessions, cookies, and refresh mechanisms need a threat model that considers XSS, CSRF, token theft, expiry, and cross-origin behavior.
Do not store secrets in client-side code. Treat all client requests as potentially modified.
Security boundary
UI checks improve user experience; server-side authorization is the actual security control.
Key Takeaways
- Authentication and authorization are different concerns.
- Never trust client-side permission checks.
- Choose session/token mechanisms based on a threat model.