Authentication and Authorization
A courier logs into Tiffin to see today's deliveries. Then, out of curiosity, they type /admin/revenue into the address bar. The login worked, so should the page open? No. Logging in and being allowed are two separate questions, and mixing them up is one of the most common holes in real software.
The rule
Authentication asks who you are; authorization asks what you may do.
Authentication (authn) proves identity. The user or service presents evidence, and the system checks it. Evidence comes in three kinds of factor:
- something you know: a password or PIN
- something you have: a phone app code or a hardware key
- something you are: a fingerprint or face
Multi-factor authentication (MFA) needs factors of different kinds. A password plus a phone code is MFA; two passwords are not.
Authorization (authz) happens after identity is known. It compares that identity's roles or permissions with the action requested. The courier is authenticated, but not authorized for revenue reports.
401 Unauthorized → we don't know who you are (authentication failed or missing)
403 Forbidden → we know who you are, and you may not do this (authorization failed)Yes, the name "401 Unauthorized" is historically confusing. It really means "unauthenticated".
Machines need both too. Tiffin's deploy job authenticates to the cloud with a credential, and is authorized to update one service. Pipelines are identities, and they deserve the same care as people.
The shortcut
Picture a hotel: the front desk checks your ID (authentication) and hands you a key card that opens only your room (authorization). Every request to Tiffin's server must pass both, in that order, on the server.
Who is asking?
The request carries the courier's session token. The server verifies it: authenticated as courier Ravi.
The trap: checking permissions only in the user interface. Anyone can send a request directly, so authorization must be enforced by the server for every request.
Drills
Answer fast — trust the rule.
A user types the correct password and then approves a prompt on their phone. What is this?
A logged-in customer requests another customer's order and is refused. Which status code fits best?
Which of these is an authorization decision?
Tiffin hides the "Refund" button from non-managers. What is still missing?
Remember
- Authentication asks who you are; authorization asks what you may do.
- Front desk checks ID, key card opens one room: both, in order, on the server.
- Pipelines and services are identities too; authenticate and authorize them like people.