Authentication vs Authorization

Authentication verifies who you are (identity). Authorization determines what you are allowed to do (permissions). They are distinct but complementary security functions that are often confused.

Category: Security (also: Web Development)

Author: Atomic Glue Security Team

## Definition

Authentication is the process of confirming the identity of a user, device, or system. It answers the question 'Who are you?' Common methods include passwords, biometrics, security tokens, and OAuth. Authorization is the process of granting or denying access to resources based on the authenticated identity. It answers 'What are you allowed to do?' Authorization relies on policies, roles, permissions, and access control lists (ACLs). Both are required for secure systems, and they must be kept logically separate in application architecture.

## How They Work Together

Authentication always comes first. You must establish identity before you can check permissions. In a typical web app, authentication happens via login (username/password, SSO, OAuth), which creates a session or issues a token. Every subsequent request carries that proof of identity. Authorization checks are then performed on each request: 'Is this authenticated user allowed to view this resource, perform this action, or access this data?'

## Common Implementation Patterns

**RBAC (Role-Based Access Control)**: Permissions are assigned to roles, and users are assigned to roles. Simple and widely used. **ABAC (Attribute-Based Access Control)**: Permissions are evaluated dynamically based on user attributes, resource attributes, and environmental conditions. **ReBAC (Relationship-Based Access Control)**: Permissions are based on relationships between entities (e.g., 'is owner of,' 'is member of'). Google's Zanzibar popularized this pattern.

## Common Pitfalls

Confusing authentication with authorization leads to broken access control vulnerabilities. A user might be logged in (authenticated) but should not have admin access (authorization). The OWASP Top 10 2021 lists Broken Access Control as the number one web security risk. Never assume authentication implies authorization. Always check permissions on every request.

## Note

The OWASP Top 10 2021 lists 'Broken Access Control' as the most critical web security risk. Most access control failures stem from not separating authn from authz in code.

## Common questions

Q: Which comes first, authentication or authorization?

A: Authentication always comes first. You cannot authorize an unidentified user. The typical flow is: authenticate -> issue session/token -> authorize on each request.

Q: Is OAuth authentication or authorization?

A: OAuth 2.0 is an authorization framework. It delegates authorization but is often used for authentication via OpenID Connect (OIDC) on top.

Q: What is broken access control?

A: Broken access control occurs when an application does not properly enforce who can access what. For example, a user with a guest role accessing an admin endpoint by guessing the URL.

## Key takeaways

• Authentication = identity. Authorization = permissions.
• Always authenticate first, then authorize on every request.
• Broken access control is the #1 OWASP Top 10 risk (2021).
• Use RBAC, ABAC, or ReBAC frameworks rather than ad-hoc checks.

## Related entries

• [OAuth 2.0](atomicglue.co/glossary/oauth-20)
• [SSO](atomicglue.co/glossary/sso)
• [JWT](atomicglue.co/glossary/jwt-backend)

Last updated December 2024. Permalink: atomicglue.co/glossary/authentication-vs-authorization-security