Authentication vs Authorization: Who You Are vs What You Can Do
Authentication proves who you are, like passport control. Authorization decides what you may do once you're in, like a boarding pass and a lounge door. Even the HTTP status codes are misnamed: 401 Unauthorized really means unauthenticated, and 403 Forbidden is the real not-authorized.
Authentication is proving who you are — a passport check, done once per session. Authorization is deciding what that identity may do — checked on every action, like a boarding pass at the gate and a keycard at the lounge door. The HTTP status codes are famously misnamed: a 401 Unauthorized response actually means you aren't authenticated at all, while 403 Forbidden is the real you're-not-allowed-to-do-this. Authenticate once, authorize every action, and grant only the least privilege each action needs.
Transcript
Two words get swapped constantly, and swapping them is how systems get breached: authentication and authorization. They sound like twins. They check completely different things. Picture an airport. One gate checks who you are; the next checks where your pass can take you. So which check is which — and why must they happen in that order?
Authentication is passport control. It answers one question: are you really who you claim to be? You hand over proof — a password, a passkey, a fingerprint. The system checks that proof against what it knows and confirms your identity. That's it. Authentication says who you are — it says nothing yet about what you can do.
Authorization is the boarding pass and the lounge door. You're already identified — now it checks what THIS person is allowed to do: this flight, this seat, this lounge. It maps your identity to permissions — roles, scopes, policies — and grants or denies each one. Authorization says what you can do, and two known people can have totally different access.
Now the catch that trips up even senior engineers — and it's baked into the web. The HTTP status codes for these two are misnamed, and they're backwards from what you'd guess. 401 Unauthorized is really the passport gate saying I don't know you — go authenticate. 403 Forbidden is the lounge door: I know you fine, but this isn't your lounge.
In practice the order is strict: authenticate first, because you can't decide what someone may do until you know who they are. Never run the checks the other way around. And you authenticate once at the door, but authorize on EVERY action — because a valid login is not a permission slip. Give each identity the least access it needs.
So they're two passes, not one. The passport proves who holds it; the boarding pass proves where that holder can go. Prove identity first, then check permission — every single time. Next time you write 'auth' in your code, stop and ask which one you mean: am I checking who this is — or what they're allowed to do?