Comparison
AuthenticationvsAuthorization
Authentication
you verify the caller is who they claim to be, before you have any opinion at all about what they may do.
Establishing identity — proving that a request comes from a particular principal, via a password, a token, a certificate or a signature. It answers exactly one question: who is this. Everything about permissions is a separate concern, and conflating the two is how endpoints end up checking that someone is logged in and nothing else.
Full entry →Authorization
you check whether this particular user is allowed to touch this particular record, not merely that they are logged in.
Deciding whether an authenticated principal may perform an action on a resource. The dangerous gap is object-level: the endpoint checks the role but not that the record belongs to the caller, so changing an id in the URL returns someone else's data. It must be enforced server-side per request, on every path that reaches the resource.
Full entry →