Authentication vs. Authorization

Proving who you are versus what you're allowed to do — and the protocols behind each.

What it is

Authentication (AuthN) verifies identity — who is this? Authorization (AuthZ) determines permissions — what are they allowed to do? They're independent: a system can authenticate someone correctly and still deny them access to a specific resource.

Key points

Authentication mechanisms: passwords (weakest alone), MFA, and delegated authentication via OAuth 2.0 / OpenID Connect (OIDC adds identity on top of OAuth's authorization).
Session vs. token-based auth: server-side sessions require server state; JWTs are stateless but harder to revoke early — a real tradeoff, not a strict upgrade.
Authorization models: role-based access control (RBAC) assigns permissions via roles; attribute-based (ABAC) evaluates policies against attributes for finer-grained control.
The principle of least privilege — grant only the access needed, nothing more — is the organizing idea behind good authorization design.