Authentication vs Authorization: Do Not Mix Them Up

“Understand identity, permissions, sessions and where security checks belong.”

Authentication vs Authorization

Authentication asks: Who are you?

Authorization asks: What are you allowed to do?

A user can authenticate using password, passkey, OAuth, SSO or a magic link.

Suppose the caller requests:

GET /api/notes/abc

Knowing the user ID is not enough.

SELECT *
FROM notes
WHERE id = $1
  AND student_id = $2;

That is authorization.

{isAdmin && <DeleteButton />}

This improves UX, but authorization must still exist in trusted server-side code.

Generating diagram...

Warning

Never trust permission flags supplied by the browser without validating them against trusted server state.

Finished this article?

Mark it done to update your series progress.