Authentication answers the question "Who are you?" and is concerned with verifying a user's identity. Authorization answers "What do you want?" and determines what permissions or access that identified user has. The chapter treats them as separate concerns, noting that OAuth2 is a standard covering both.

Authentication (authn) is defined as the step of establishing identity, which the chapter phrases as "Who are you?" It requires mapping some form of secret information to a unique identity, such as username/password, an API key, or OAuth2 credentials. Authorization (authz) is defined as determining what a user is allowed to do, phrased as "What do you want?". It follows authentication and involves assigning different permissions to visitors and endpoints. The chapter warns that books and articles often muddle the two, and it emphasizes the need to first ask whether either is needed at all. In its example section, the HTTP 401 status code is described as officially named "Unauthorized" even though it really means "unauthenticated."

Key points

Authentication answers "Who are you?"
Authorization answers "What do you want?"
Authentication is concerned with identity: establishing who a visitor is.
Authorization involves assigning permissions for specific visitors and endpoints.
The chapter notes that OAuth2 is a standards set that covers both authentication and authorization.
The chapter warns that authentication and authorization are often muddled in web development discussions.

What is the difference between authentication and authorization as defined in this chapter?

Related questions