Authentication vs authorization?
Options
- They are the same thing under two different names
- Authentication proves identity; authorization sets access (Correct option)
- Authorization happens before authentication does
- Authentication is only needed for admin accounts
Answer
Authentication = proving WHO you are (login); authorization = deciding WHAT you are allowed to do
Why
Authentication (authn): the system checks your identity, with a password, token, fingerprint or MFA code.
Authorization (authz): knowing who you are, the system checks your permissions: can this user delete this project?
Authentication always comes first. In HTTP: 401 = not authenticated, 403 = authenticated but not authorized.
Remember
Authn = who you are. Authz = what you can do.