Authentication vs Authorization
Authentication proves who you are; authorization decides what you may do. Authentication comes first and establishes identity — a password, a passkey, a token. Authorization comes next and enforces what that identity is permitted to access. Confusing the two, or doing the first and forgetting the second, is behind a huge share of real breaches.
How do the two steps work together?#
Think of a hotel. The front desk authenticates you against your reservation and issues a key card — that is identity. The key card then authorizes you: it opens your room and the gym, but not other guests’ rooms or the manager’s office. One step proves who you are; the other constrains what that proof lets you do.
| Authentication | Authorization | |
|---|---|---|
| Question | Who are you? | What may you do? |
| Happens | First | After authentication |
| Mechanism | Passwords, MFA, keys, tokens | Roles, permissions, policies |
| Typical failure | Weak credentials, stolen tokens | Broken access control, IDOR |
Why is authorization the bigger source of bugs?#
Because authentication is a solved, well-supported problem — use a proven library and MFA — while
authorization is bespoke logic scattered across every endpoint. The classic failure: user 4711
requests /invoices/4712 and the app returns it because it checked that you are logged in but
not that this invoice is yours. That is broken access control, and it tops the OWASP Top 10.
Authorization is where least privilege is enforced, and its web-layer failures are the top entry in the OWASP Top 10. More foundations at the Security Fundamentals hub.
Frequently asked questions#
What is the difference between authentication and authorization?
Authentication answers "who are you?" and verifies identity, usually with a password, token, or key. Authorization answers "what are you allowed to do?" and enforces permissions on that identity. Authentication always comes first; authorization decides what the now-known user may access.
Which one causes more security bugs?
Authorization. Broken access control — where an authenticated user reaches data or actions they should not — is the number-one category in the OWASP Top 10. Authentication gets most of the attention, but the quieter, more common failure is checking who someone is and then forgetting to check what they may do.