Authentication & Authorization Explained

Authentication & Authorization Explained

From Cookies to OAuth 2.1

Introduction

Authentication and authorization are two of the most fundamental concepts in application security. Every modern application—whether it's a social media platform, an e-commerce website, a banking system, or a REST API—relies on these mechanisms to protect resources and ensure that only legitimate users can access sensitive information.

Whenever a client sends a request to a protected resource, the server must answer two fundamental questions.

The first question is answered through authentication.

The second question is answered through authorization.

Although these concepts are closely related and are often implemented together, they solve entirely different problems.

Authentication establishes identity.

Authorization enforces permissions.

Every secure application requires both.

1. Authentication

Authentication is the process of verifying the identity of a user, application, or device before access to a protected resource is granted.

Its primary objective is to answer a single question.

"Who are you?"

An authentication system attempts to prove that the entity making a request is genuinely who it claims to be.

Modern authentication systems generally rely on one or more authentication factors.

Information that only the legitimate user should know.

Examples include:

A physical object or digital device possessed by the legitimate user.

Examples include:

Biological characteristics unique to an individual.

Examples include:

Modern security systems often combine multiple authentication factors to improve account security.

This approach is known as Multi-Factor Authentication (MFA).

2. Authorization

Authorization is the process of determining which resources or operations an authenticated identity is permitted to access.

Unlike authentication, authorization assumes that identity verification has already been completed.

Its primary objective is to answer a different question.

"What are you allowed to do?"

Consider a project management application.

An Administrator may be allowed to:

A Team Member may only be allowed to:

Both users are successfully authenticated.

However, they receive different permissions because authorization policies determine which actions each identity is allowed to perform.

Authorization decisions are commonly based on:

Unlike authentication, authorization may occur multiple times during a single session because every protected request may require a new permission evaluation.