Authentication vs Authorization

Who are you vs what can you do?

Authentication and authorization are two halves of access control, but they answer fundamentally different questions. Confusing them is a common source of security vulnerabilities.

Authentication

Authentication (authn) is the process of verifying identity — proving you are who you claim to be. It answers the question 'Who are you?' Common mechanisms include passwords, biometrics, multi-factor authentication (MFA), OAuth tokens, and certificates. After successful authentication, the system knows your identity.

Authorization

Authorization (authz) is the process of determining what a verified identity is allowed to do. It answers the question 'What can you access?' Common mechanisms include role-based access control (RBAC), attribute-based access control (ABAC), access control lists (ACLs), and permission scopes. Authorization always comes after authentication.

Key Differences

- **Question answered**: Authentication = 'Who are you?' Authorization = 'What are you allowed to do?' - **Order**: Authentication always comes first. You can't authorize an unknown identity. - **Failure mode**: Authentication failure = 401 Unauthorized. Authorization failure = 403 Forbidden. - **Data used**: Authentication uses credentials (passwords, tokens, biometrics). Authorization uses permissions, roles, and policies. - **Changeability**: Your identity rarely changes. Your permissions change frequently based on context.

When to Use Each

Every secure system needs both. **Authentication** gates the front door — who can enter the building at all. **Authorization** controls which rooms they can access once inside. A common mistake is implementing authentication but treating all authenticated users equally. Even a simple app usually needs at least admin vs. regular user authorization.

Analogy

**Authentication** is showing your boarding pass and ID at the airport gate — proving you're the person on the ticket. **Authorization** is your seat assignment and class of service — just because you're on the plane doesn't mean you can sit in first class or enter the cockpit.