What is the difference between authentication and authorization?
Model answer
Authentication (authn) answers "who are you?". It checks identity with a password, a one-time code, a passkey or a token. Authorization (authz) answers "what are you allowed to do?". It decides whether that identity may perform an action on a resource.
Authentication always comes first, because permissions are attached to an identity. Think of an airport: the passport check proves who you are, and the boarding pass decides which flight you can enter.
request -> authenticate (who?) -> authorize (may they?) -> handler
| |
401 if missing 403 if forbidden
In a backend, authentication usually happens once per request in middleware, producing a user identity. Authorization must happen for every action and every object, for example "can this user edit invoice 42?". Passing one does not imply the other: a logged-in user is not allowed to read everything.
Takeaway: verify identity once, then check permission on every resource access.
Key points
- Authentication proves identity, authorization grants permission
- Authentication comes first
- Authorization is checked per action and per object
- Typical failures are 401 and 403
Likely follow-ups
- When do you return 401 and when 403?
- Where in the request pipeline would you put each check?
Common mistakes
- Assuming a logged-in user may access any resource
- Checking permission only in the UI instead of the API