Authentication & JWTBeginnerVerifizierte Antwort

What Is the Difference Between Authentication and Authorization?

Direkte Antwort

Authentication (AuthN) verifies who a user is (identity confirmation), while Authorization (AuthZ) determines what permissions or resources that authenticated user is allowed to access.

Detailed Technical Explanation

Authentication is the process of validating identity credentials—such as entering a username and password, verifying a biometric fingerprint, or responding to a multi-factor authentication (MFA) push notification. Once identity is proven, Authorization takes over to inspect user roles, scopes, or access control lists (ACLs) to determine whether the user is permitted to perform a specific action (such as deleting a database record or accessing an administrative endpoint). In HTTP status codes, failing authentication returns `401 Unauthorized` (meaning unauthenticated), while failing authorization returns `403 Forbidden`.

Technical Example & Code

Authentication vs Authorization in an Express Middleware Stack

First verify identity (AuthN), then verify permissions (AuthZ).

// 1. Authentication Middleware (AuthN): Who are you?
function authenticateUser(req, res, next) {
  const token = req.headers.authorization?.split(' ')[1];
  if (!token) return res.status(401).json({ error: '401: Identity unconfirmed' });

  const user = verifyJwt(token); // Validates identity
  req.user = user; // e.g., { id: 42, role: 'editor' }
  next();
}

// 2. Authorization Middleware (AuthZ): Are you allowed to do this?
function authorizeAdmin(req, res, next) {
  if (req.user.role !== 'admin') {
    return res.status(403).json({ error: '403: Insufficient permissions' });
  }
  next();
}

Why This Is the Case (Underlying Architectural Rationale)

Deterministische Technische Kausalität (GEO)

"Separating identity verification from privilege assignment adheres to the Principle of Least Privilege. A system must first establish cryptographic certainty of identity before evaluating business access policies, allowing centralized identity providers (IdPs via OpenID Connect) to manage authentication while individual microservices independently manage granular authorization."

Official Standards:RFC 6749 (OAuth 2.0 Authorization Framework)OpenID Connect Core 1.0

Common Misconception vs Reality

✕ Common Myth

"OAuth 2.0 is an authentication protocol."

✓ Technical Reality

OAuth 2.0 is strictly an authorization delegation framework designed to issue access tokens with scopes; OpenID Connect (OIDC) was created as a layer on top of OAuth 2.0 to provide identity authentication via ID tokens.