[security] Authentication versus Authorization

What's the difference in context of web applications? I see the abbreviation "auth" a lot. Does it stand for auth-entication or auth-orization? Or is it both?

This question is related to security authorization authentication

The answer is


The confusion is understandable, since the two words sound similar, and since the concepts are often closely related and used together. Also, as mentioned, the commonly used abbreviation Auth doesn't help.

Others have already described well what authentication and authorization mean. Here's a simple rule to help keep the two clearly apart:

  • Authentication validates your Identity (or authenticity, if you prefer that)
  • Authorization validates your authority, i.e. your right to access and possibly change something.

Definitions

Authentication - Are you the person you claim to be?

Authorization - Are you authorized to do whatever it is you're trying to do?

Example

A web app uses Google Sign-In. After a user successfully signs in, Google sends back:

  1. A JWT token. This can be validated and decoded to get authentication information. Is the token signed by Google? What is the user's name and email?
  2. An access token. This authorizes the web app to access Google APIs on behalf of the user. For example, can the app access the user's Google Calendar events? These permissions depend on the scopes that were requested, and whether or not the user allowed it.

Additionally:

The company may have an admin dashboard that allows customer support to manage the company's users. Instead of providing a custom signup solution that would allow customer support to access this dashboard, the company uses Google Sign-In.

The JWT token (received from the Google sign in process) is sent to the company's authorization server to figure out if the user has a G Suite account with the organization's hosted domain ([email protected])? And if they do, are they a member of the company's Google Group that was created for customer support? If yes to all of the above, we can consider them authenticated.

The company's authorization server then sends the dashboard app an access token. This access token can be used to make authorized requests to the company's resource server (e.g. ability to make a GET request to an endpoint that sends back all of the company's users).


Adding to @Kerrek's answer;

Authentication is Generalized form (All employees can login in to the machine )

Authorization is Specialized form (But admin only can install/uninstall the application in Machine)


I have tried to create an image to explain this in the most simple words

1) Authentication means "Are you who you say you are?"

2) Authorization means "Should you be able to do what you are trying to do?".

This is also described in the image below.

enter image description here

I have tried to explain it in the best terms possible, and created an image of the same.


Authentication is the process of verifying your log in username and password.

Authorization is the process of verifying that you can access to something.


Authentication is the process of verifying the proclaimed identity.

  • e.g. username/password

Usually followed by authorization, which is the approval that you can do this and that.

  • e.g. permissions

In short, please. :-)

Authentication = login + password (who you are)

Authorization = permissions (what you are allowed to do)

Short "auth" is most likely to refer either to the first one or to both.


Authentication is a process of verification:

  • user identity in a system(username, login, phone number, email...) by providing a proof (secret key, biometrics, sms...). Multi-factor authentication as an extension.
  • email checking using digital signature[About]
  • checksum

Authorization is the next step after Authentication. It is about permissions/roles/privileges to resources. OAuth (Open Authorization) is an example of Authorization


Imagine that you have registered for a tech conference. You arrive and walk up to the registration table outside to get your conference badge. You have to first show some form of identification, such as a driver's license. Your driver's license identifies you (with your picture, for example) and is distributed by a trusted entity (the DMV). This is authentication.

The person hands you your badge, which is red, blue, or green. Walking around inside the conference, some of the exhibits are color-coded. With a green badge, you can enter the green exhibits, but not the blue or red exhibits. The badge is not distributed by the DMV -- rather, it is distributed by the conference itself, to access conference resources inside the conference hall.

There is not necessarily anything about the badge that identifies you (it may have your name printed on it, but you can easily borrow your friend's blue badge to visit a blue exhibit -- nobody is going to check your name, just the color blue). The color of your badge grants you access to exhibits. This is authorization.


I found the analogy from this article really help me.

Consider a person walking up to a locked door to provide care to a pet while the family is away on vacation. That person needs:

  • Authentication is in the form of a key. The lock on the door only grants access to someone with the correct key in much the same way that a system only grants access to users who have the correct credentials.
  • Authorization is in the form of permissions. Once inside, the person has the authorization to access the kitchen and open the cupboard that holds the pet food. The person may not have permission to go into the bedroom for a quick nap.

So in short, authentication is about user identity while authorization is about user permission.


I prefer Verification and Permissions to Authentication and Authorization.

It is easier in my head and in my code to think of "verification" and "permissions" because the two words

  • don't sound alike
  • don't have the same abbreviation

Authentication is verification and Authorization is checking permission(s). Auth can mean either, but is used more often as "User Auth" i.e. "User Authentication"


As Authentication vs Authorization puts it:

Authentication is the mechanism whereby systems may securely identify their users. Authentication systems provide an answers to the questions:

  • Who is the user?
  • Is the user really who he/she represents himself to be?

Authorization, by contrast, is the mechanism by which a system determines what level of access a particular authenticated user should have to secured resources controlled by the system. For example, a database management system might be designed so as to provide certain specified individuals with the ability to retrieve information from a database but not the ability to change data stored in the datbase, while giving other individuals the ability to change data. Authorization systems provide answers to the questions:

  • Is user X authorized to access resource R?
  • Is user X authorized to perform operation P?
  • Is user X authorized to perform operation P on resource R?

See also:


Examples related to security

Monitoring the Full Disclosure mailinglist Two Page Login with Spring Security 3.2.x How to prevent a browser from storing passwords JWT authentication for ASP.NET Web API How to use a client certificate to authenticate and authorize in a Web API Disable-web-security in Chrome 48+ When you use 'badidea' or 'thisisunsafe' to bypass a Chrome certificate/HSTS error, does it only apply for the current site? How does Content Security Policy (CSP) work? How to prevent Screen Capture in Android Default SecurityProtocol in .NET 4.5

Examples related to authorization

How to send custom headers with requests in Swagger UI? How do you create a custom AuthorizeAttribute in ASP.NET Core? ASP.NET Web API : Correct way to return a 401/unauthorised response How to get http headers in flask? How to define the basic HTTP authentication using cURL correctly? basic authorization command for curl MongoDB "root" user How to use basic authorization in PHP curl How to get user name using Windows authentication in asp.net? Python requests library how to pass Authorization header with single token

Examples related to authentication

Set cookies for cross origin requests How Spring Security Filter Chain works What are the main differences between JWT and OAuth authentication? http post - how to send Authorization header? ASP.NET Core Web API Authentication Token based authentication in Web API without any user interface Custom Authentication in ASP.Net-Core Basic Authentication Using JavaScript Adding ASP.NET MVC5 Identity Authentication to an existing project LDAP: error code 49 - 80090308: LdapErr: DSID-0C0903A9, comment: AcceptSecurityContext error, data 52e, v1db1