TOPIC SECURITY
AuthN vs AuthZ who you are vs what you may do
IN 10 SECONDS
Authentication (AuthN) verifies your identity (who you are). Authorization (AuthZ) verifies your access privileges (what resources you are permitted to open or modify).
GOTCHA A user can be authenticated (valid login) but unauthorized (no access to resource). Make sure your API handles AuthZ separately from AuthN.
HOW IDENTITY TO PERMISSION FLOWS
01 Authentication (AuthN) user logs in with password and MFA. System issues ID token.
02 Identity confirmed system validates token signature: 'this user is indeed John Doe'.
03 Authorization (AuthZ) John requests admin page. Policy checker evaluates roles.
04 Access decision John is not an admin, so system throws a 403 Forbidden error.
POKE IT YOURSELF
curl -u username:password https://api.example.com — authenticate via Basic Auth
Drill this topic →
~60 sec read