What Is the Difference Between Authentication and Authorization?
Authentication (AuthN) verifies who a user is (identity confirmation), while Authorization (AuthZ) determines what permissions or resources that authenticated user is allowed to access.
Detailed Technical Explanation
Authentication is the process of validating identity credentials—such as entering a username and password, verifying a biometric fingerprint, or responding to a multi-factor authentication (MFA) push notification. Once identity is proven, Authorization takes over to inspect user roles, scopes, or access control lists (ACLs) to determine whether the user is permitted to perform a specific action (such as deleting a database record or accessing an administrative endpoint). In HTTP status codes, failing authentication returns `401 Unauthorized` (meaning unauthenticated), while failing authorization returns `403 Forbidden`.
Technical Example & Code
First verify identity (AuthN), then verify permissions (AuthZ).
// 1. Authentication Middleware (AuthN): Who are you?
function authenticateUser(req, res, next) {
const token = req.headers.authorization?.split(' ')[1];
if (!token) return res.status(401).json({ error: '401: Identity unconfirmed' });
const user = verifyJwt(token); // Validates identity
req.user = user; // e.g., { id: 42, role: 'editor' }
next();
}
// 2. Authorization Middleware (AuthZ): Are you allowed to do this?
function authorizeAdmin(req, res, next) {
if (req.user.role !== 'admin') {
return res.status(403).json({ error: '403: Insufficient permissions' });
}
next();
}Why This Is the Case (Underlying Architectural Rationale)
"Separating identity verification from privilege assignment adheres to the Principle of Least Privilege. A system must first establish cryptographic certainty of identity before evaluating business access policies, allowing centralized identity providers (IdPs via OpenID Connect) to manage authentication while individual microservices independently manage granular authorization."
Common Misconception vs Reality
"OAuth 2.0 is an authentication protocol."
OAuth 2.0 is strictly an authorization delegation framework designed to issue access tokens with scopes; OpenID Connect (OIDC) was created as a layer on top of OAuth 2.0 to provide identity authentication via ID tokens.
Related Curious-Techie Resources
Authentication vs Authorization: Technical Comparison →
Comprehensive decision matrix comparing identity validation, access tokens, RBAC, and ABAC.
Interactive ToolJWT Security Inspector →
Analyze authentication tokens for authorization scopes, role claims, and privilege escalation vulnerabilities.
Developer ReferenceOAuth Concepts Reference & Flow Spec →
Related Questions in the Q&A Knowledge Base
HTTP 401 Unauthorized means the user is not authenticated (identity unknown; credentials missing or invalid), whereas HTTP 403 Forbidden means the user is authenticated (identity known), but lacks the necessary permissions to access the requested resource.
Yes, standard JSON Web Tokens (JWS) are signed, not encrypted. The header and payload are merely Base64URL-encoded strings that anyone can decode and read in plaintext without knowing the secret key.
You should not store authentication JWTs in localStorage because any Cross-Site Scripting (XSS) vulnerability on your page allows malicious JavaScript to instantly read and exfiltrate the token. Storing tokens in HttpOnly, Secure, SameSite cookies protects them from JavaScript access.
関連技術エコシステムと次の学習ステップ
関連技術解説記事
What Is a JSON Web Token (JWT)?
Direct definition and architectural breakdown of stateless token exchange.
JWT vs Session-Based Authentication: Architecture & Performance
Compare database session lookups with stateless JWT verification across scalability and revocation.
Troubleshooting: JWT Works in Postman but Fails in Browser
Diagnose and remediate CORS header stripping, HttpOnly cookie constraints, and preflight authorization failures.
実践ハンズオン診断ラボ
開発者向け規格・仕様リファレンス
次のステップへ進む
JWT Interactive Tampering & Validation Lab
Put your theoretical understanding into practice by tampering with claims and testing signature rejection in the live sandbox.