Authentication and authorization

At a glance

Authentication question

Who is making the request?

Authorization question

May this requester perform this action?

Overview

Authentication establishes an identity or verifies a claim about it, while authorization decides what that identity may do. Applications usually need both. A successful sign-in is therefore a prerequisite for some actions, not a blanket grant of access to every resource.

What differs

Authentication evaluates credentials or an existing session. Authorization evaluates access to an action or resource using the application's rules, including ownership, roles, and other relevant context.

Choose by the task

Investigate authentication when identity or session verification fails. Investigate authorization when the identity is known but the requested operation should be allowed or denied under a specific rule.

Common confusion

Hiding a control in the interface does not enforce permission on the server. Each protected operation needs a trustworthy access decision at the boundary that actually performs it.

Sources and review

MOOR's explanatory text is supported by the following source links.

1. Authentication cheat sheet — OWASP
2. Authorization cheat sheet — OWASP