What is the difference between authentication and authorization, and how do they work together?

Question

Accepted Answer

Authentication and authorization are two distinct security concepts that work together to protect systems.

Authentication, often abbreviated AuthN, verifies identity. It answers the question: who are you? The user proves their identity through credentials like passwords, biometrics, or security tokens. After successful authentication, the system knows who is making requests.

Authorization, often abbreviated AuthZ, determines permissions. It answers the question: what are you allowed to do? Once identity is established, authorization decides which resources and actions the authenticated user can access.

Authentication always comes first. You cannot determine permissions without knowing who is asking. Think of a building. Authentication is showing your ID badge at the entrance. Authorization determines which floors and rooms your badge grants access to.

Common authentication methods include password-based login, multi-factor authentication combining something you know, have, and are, OAuth tokens for delegated access, and certificate-based authentication.

Common authorization models include role-based access control, or RBAC, where permissions are assigned to roles and users are assigned roles. Attribute-based access control, or ABAC, makes decisions based on user attributes, resource attributes, and environmental conditions. Access control lists specify which users can access which resources.

In web applications, authentication typically happens at login, producing a session or token. Authorization checks occur on every request, verifying the authenticated user has permission for the requested action.

Common mistakes include confusing the two concepts, performing authorization checks without proper authentication, or implementing authentication without granular authorization. Both are necessary for a complete security model.