2 min lesson
Authentication & authorization
Walk through each part of "Authentication & authorization", then explain what each one does.
Step 1 of 3
Authentication asks "who are you?" Authorization asks "are you allowed to do this?" Most real-world breaches you'll review aren't login bypasses - they're authorization that someone forgot to write.
The two words, kept straight
- Authentication (authn)
- Proving identity: passwords, OAuth, SSOSingle Sign-On. One company login (usually via SAML or OIDC) instead of a separate password per tool. Press Enter for the full definition., MFA, session establishment. A failure here = impersonation.
- Authorization (authz)
- Enforcing permission on every request, per object: can THIS user do THIS to THIS resource? A failure here = privilege escalation or data leak.
Authn happens once at the door; authz must happen on every action behind it.