Authentication versus Authorization

security authorization authentication
daGrevis picture daGrevis · Jul 2, 2011 · Viewed 236.4k times · Source

What's the difference in context of web applications? I see the abbreviation "auth" a lot. Does it stand for auth-entication or auth-orization? Or is it both?

Answer

Kerrek SB picture Kerrek SB · Jul 2, 2011

Authentication is the process of ascertaining that somebody really is who they claim to be.

Authorization refers to rules that determine who is allowed to do what. E.g. Adam may be authorized to create and delete databases, while Usama is only authorised to read.

The two concepts are completely orthogonal and independent, but both are central to security design, and the failure to get either one correct opens up the avenue to compromise.

In terms of web apps, very crudely speaking, authentication is when you check login credentials to see if you recognize a user as logged in, and authorization is when you look up in your access control whether you allow the user to view, edit, delete or create content.

Related questions

Best way to create a TOKEN system to authenticate web service calls?

I'd like to create a web service architecture that can be called by various platforms such as mobile devices, winforms applications, iphone, blackberry, you name it. So going with something like WCF and wsHttp binding probably kills this and I …

Read More
Proper authorization rules for protected content in firebase

Is there a best practice approach to proper authorization rules for protected content in a firebase app using firepad specifically By protected content I mean where a user creates a document and only shares it with certain other users). Also …

Read More
Writing custom Shiro realm

I am constructing my own AuthorizingRealm subclass, and am having a tough time wiring it up to my SecurityManager. The essence of my realm: public class MyRealm extends AuthorizingRealm { protected AuthenticationInfo doGetAuthenticationInfo(AuthenticationToken token) throws AuthenticationException { try { // My custom logic …

Read More