Authentication establishes identity; authorization decides what the identity may access.

How to apply it

Use secure sessions or suitable OAuth/OIDC flows. Configure cookie attributes, expiry, rotation, revocation, and CSRF defenses. Hash passwords with a modern password-hashing algorithm. Enforce deny-by-default RBAC plus resource and tenant checks on every protected operation.

Worked example

Verify active membership, query a project by both project ID and organization ID, and check capability before returning it.

Common mistakes to avoid

Storing plaintext passwords, logging tokens, trusting client roles, or checking only that the user is logged in.

Practice task

Implement this concept in the capstone. Add one positive test, one negative or failure-path test, and a short note explaining the trade-off you chose.