Authentication & Authorization Explained

Authentication & Authorization Explained

From Cookies to OAuth 2.1

Introduction

Authentication and authorization are two of the most fundamental concepts in application security. Every modern application—whether it's a social media platform, an e-commerce website, a banking system, or a REST API—relies on these mechanisms to protect resources and ensure that only legitimate users can access sensitive information.

Whenever a client sends a request to a protected resource, the server must answer two fundamental questions.

• Who is making this request?

• What is this requester allowed to do?

The first question is answered through authentication.

The second question is answered through authorization.

Although these concepts are closely related and are often implemented together, they solve entirely different problems.

Authentication establishes identity.

Authorization enforces permissions.

Every secure application requires both.

1. Authentication

   Authentication is the process of verifying the identity of a user, application, or device before access to a protected resource is granted.

   Its primary objective is to answer a single question.

   "Who are you?"

   An authentication system attempts to prove that the entity making a request is genuinely who it claims to be.

   Modern authentication systems generally rely on one or more authentication factors.

   • Something You Know

   Information that only the legitimate user should know.

   Examples include:

    • Password
   
    • PIN
   
    • Security Question
   

   • Something You Have

   A physical object or digital device possessed by the legitimate user.

   Examples include:

    • Mobile Phone
   
    • Hardware Security Key
   
    • Authenticator Application
   
    • Smart Card
   

   • Something You Are

   Biological characteristics unique to an individual.

   Examples include:

    • Fingerprint
   
    • Facial Recognition
   
    • Retina Scan
   
    • Voice Recognition
   

   Modern security systems often combine multiple authentication factors to improve account security.

   This approach is known as Multi-Factor Authentication (MFA).

2. Authorization

   Authorization is the process of determining which resources or operations an authenticated identity is permitted to access.

   Unlike authentication, authorization assumes that identity verification has already been completed.

   Its primary objective is to answer a different question.

   "What are you allowed to do?"

   Consider a project management application.

   An Administrator may be allowed to:

   • Create Projects

   • Delete Projects

   • Manage Users

   • Configure Application Settings

   • Access Billing Information

   A Team Member may only be allowed to:

   • View Projects

   • Create Tasks

   • Update Assigned Tasks

   • Upload Attachments

   Both users are successfully authenticated.

   However, they receive different permissions because authorization policies determine which actions each identity is allowed to perform.

   Authorization decisions are commonly based on:

   • Roles

   • Individual Permissions

   • Access Control Lists (ACL)

   • Attribute-Based Access Control (ABAC)

   • Organizational Policies

   Unlike authentication, authorization may occur multiple times during a single session because every protected request may require a new permission evaluation.