What is the Difference Between Authorization and Authentication?

// Simple authentication example
async function authenticate(email, password) {
  const response = await fetch('/api/auth/login', {
    method: 'POST',
    headers: { 'Content-Type': 'application/json' },
    body: JSON.stringify({ email, password })
  });
  
  if (response.ok) {
    const { token } = await response.json();
    // Save token for subsequent requests
    localStorage.setItem('authToken', token);
    return true;
  }
  
  return false;
}

// Access control check example
function checkAuthorization(user, resource, action) {
  // Check user role
  if (action === 'delete' && user.role !== 'admin') {
    throw new Error('Insufficient permissions to delete');
  }
  
  // Check resource ownership
  if (action === 'edit' && resource.ownerId !== user.id) {
    throw new Error('You can only edit your own resources');
  }
  
  return true;
}

// Middleware to protect routes
function requireAdmin(req, res, next) {
  if (req.user?.role !== 'admin') {
    return res.status(403).json({ error: 'Access denied' });
  }
  next();
}

// 1. AUTHENTICATION — verify who the user is
app.post('/api/auth/login', async (req, res) => {
  const { email, password } = req.body;
  
  const user = await User.findOne({ email });
  if (!user || !await user.comparePassword(password)) {
    return res.status(401).json({ error: 'Invalid credentials' });
  }
  
  const token = generateJWT(user);
  res.json({ token, user: { id: user.id, role: user.role } });
});

// 2. AUTHORIZATION — verify access permissions
app.delete('/api/posts/:id', authenticateToken, async (req, res) => {
  const post = await Post.findById(req.params.id);
  
  // Check permissions: only author or admin can delete
  if (post.authorId !== req.user.id && req.user.role !== 'admin') {
    return res.status(403).json({ error: 'Insufficient permissions' });
  }
  
  await post.delete();
  res.json({ success: true });
});

// Authentication middleware
function authenticateToken(req, res, next) {
  const token = req.headers.authorization?.split(' ')[1];
  
  if (!token) {
    return res.status(401).json({ error: 'Authentication required' });
  }
  
  try {
    req.user = verifyJWT(token);
    next();
  } catch (error) {
    return res.status(401).json({ error: 'Invalid token' });
  }
}

┌─────────────────┐
│      User       │
└────────┬────────┘
         │
         ▼
┌─────────────────────────┐
│   1. AUTHENTICATION     │
│   "Who are you?"        │
│   Login + Password      │
└────────┬────────────────┘
         │
         ▼
    ✓ Success
         │
         ▼
┌─────────────────────────┐
│   2. AUTHORIZATION      │
│   "What can you do?"    │
│   Permission check      │
└────────┬────────────────┘
         │
         ▼
    ✓ Access granted
         │
         ▼
┌─────────────────────────┐
│   Access to resource    │
└─────────────────────────┘

// 401 Example
res.status(401).json({ error: 'Login required' });

// 403 Example
res.status(403).json({ error: 'Access denied' });