Loading...
Loading...
By continuing to use the platform, you accept the terms of the Privacy Policy and the use of cookies.
Authentication and Authorization are two different but interconnected security processes in web applications.
Authentication is the process of verifying user identity. The system determines who you are.
// Simple authentication example
async function authenticate(email, password) {
const response = await fetch('/api/auth/login', {
method: 'POST',
headers: { 'Content-Type': 'application/json' },
body: JSON.stringify({ email, password })
});
if (response.ok) {
const { token } = await response.json();
// Save token for subsequent requests
localStorage.setItem('authToken', token);
return true;
}
return false;
}
Authorization is the process of verifying access rights. The system determines what you are allowed to do.
// Access control check example
function checkAuthorization(user, resource, action) {
// Check user role
if (action === 'delete' && user.role !== 'admin') {
throw new Error('Insufficient permissions to delete');
}
// Check resource ownership
if (action === 'edit' && resource.ownerId !== user.id) {
throw new Error('You can only edit your own resources');
}
return true;
}
// Middleware to protect routes
function requireAdmin(req, res, next) {
if (req.user?.role !== 'admin') {
return res.status(403).json({ error: 'Access denied' });
}
next();
}
| Criteria | Authentication | Authorization |
|---|---|---|
| Question | "Who are you?" | "What can you do?" |
| Purpose | Verify identity | Verify permissions |
| Order | First step | Second step |
| Data | Login, password, token | Roles, permissions, policies |
| Result | Login successful / denied | Access granted / denied |
| HTTP Status | 401 Unauthorized | 403 Forbidden |
| Example | System login | Admin panel access |
// 1. AUTHENTICATION — verify who the user is
app.post('/api/auth/login', async (req, res) => {
const { email, password } = req.body;
const user = await User.findOne({ email });
if (!user || !await user.comparePassword(password)) {
return res.status(401).json({ error: 'Invalid credentials' });
}
const token = generateJWT(user);
res.json({ token, user: { id: user.id, role: user.role } });
});
// 2. AUTHORIZATION — verify access permissions
app.delete('/api/posts/:id', authenticateToken, async (req, res) => {
const post = await Post.findById(req.params.id);
// Check permissions: only author or admin can delete
if (post.authorId !== req.user.id && req.user.role !== 'admin') {
return res.status(403).json({ error: 'Insufficient permissions' });
}
await post.delete();
res.json({ success: true });
});
// Authentication middleware
function authenticateToken(req, res, next) {
const token = req.headers.authorization?.split(' ')[1];
if (!token) {
return res.status(401).json({ error: 'Authentication required' });
}
try {
req.user = verifyJWT(token);
next();
} catch (error) {
return res.status(401).json({ error: 'Invalid token' });
}
}
┌─────────────────┐
│ User │
└────────┬────────┘
│
▼
┌─────────────────────────┐
│ 1. AUTHENTICATION │
│ "Who are you?" │
│ Login + Password │
└────────┬────────────────┘
│
▼
✓ Success
│
▼
┌─────────────────────────┐
│ 2. AUTHORIZATION │
│ "What can you do?" │
│ Permission check │
└────────┬────────────────┘
│
▼
✓ Access granted
│
▼
┌─────────────────────────┐
│ Access to resource │
└─────────────────────────┘
// 401 Example
res.status(401).json({ error: 'Login required' });
// 403 Example
res.status(403).json({ error: 'Access denied' });