Beginner LevelAuthentication & Authorization
What is the fundamental difference between Authentication (AuthN) and Authorization (AuthZ)?
❓ Interview Prompt: Explain the core distinctions, execution order, standards, and practical examples of AuthN versus AuthZ.
While often conflated, Authentication and Authorization solve two separate identity challenges in secure software systems:
1. Authentication (AuthN) — "Who are you?":
•
Verifies and proves the identity of a user, service, or device.
•
Occurs first in the security request lifecycle.
•
Examples: Entering a password, scanning a fingerprint (Biometrics), verifying a 2FA TOTP code, or logging in via OAuth SSO.
•
Protocols: OpenID Connect (OIDC), SAML 2.0, WebAuthn/Passkeys.
2. Authorization (AuthZ) — "What are you allowed to do?":
•
Determines permissions and access rights granted to an authenticated principal.
•
Occurs second (after successful identity verification).
•
Examples: Checking if a user can delete a database row, view a financial report, or access an admin URL route.
•
Protocols: OAuth 2.0, Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC).
Code Implementation Example
typescript
// Middleware Pipeline: AuthN runs before AuthZ
async function requestPipeline(req: Request, res: Response, next: NextFunction) {
// 1. Authentication (AuthN): Verify Identity
const user = await authenticateJwtToken(req.headers.authorization);
if (!user) return res.status(401).json({ error: 'Unauthenticated: Invalid identity token' });
// 2. Authorization (AuthZ): Verify Permission
const isAllowed = await checkPermission(user, 'documents:delete');
if (!isAllowed) return res.status(403).json({ error: 'Unauthorized: Insufficient permissions' });
next();
}💡Request middleware pipeline executing AuthN first then AuthZ.
🎯 Interview Key Takeaway
Authentication verifies identity (Who you are); Authorization verifies permissions (What you can access).
#AuthN#AuthZ#Security#Middleware#Beginner
Back to all Authentication & Authorization Questions→