What is the difference between authentication and authorization?

Question

Accepted Answer

Authentication and authorization are two distinct but complementary security concepts.

Authentication answers the question "Who are you?" It is the process of verifying a user's identity. When you enter your email and password to log in, you are authenticating. The system verifies that you are indeed the person you claim to be.

Authorization answers the question "What are you allowed to do?" It is the process that determines which resources and actions an authenticated user can access. After logging in, the system checks whether you have permission to access an admin page or delete an article.

A simple analogy is an office building. Authentication is showing your badge at the entrance to prove you are an employee. Authorization is the fact that your badge gives you access to the third floor but not the fifth.

In a web application, authentication typically happens first through a login form, then authorization checks permissions on each request. For example, an authenticated user can view their own profile, but only an authorized administrator can view all user profiles.

Common technologies for authentication include passwords, JWT tokens, and OAuth. For authorization, we often use roles like admin or user, granular permissions, or attribute-based access policies.