API Fundamentals
/Beginner
Authentication vs Authorization
Definition
The two distinct security phases of access control. Authentication verifies identity. Authorization verifies permissions.
Explain Like I'm New
Authentication is the TSA agent checking your Passport to prove you are actually John Doe. Authorization is the Flight Attendant checking your ticket to ensure John Doe is allowed to sit in First Class.
Real World Example
A user logs into a WordPress site with their email and password (Authentication). They click the 'Delete Website' button, but the server rejects the request because their account role is 'Subscriber', not 'Admin' (Authorization).
Common Use Cases
- •System security
- •Role-based access control (RBAC)
Interactive Example
Loading...
Console output will appear here...
Interview Questions
basic
- Which one happens first: Authentication or Authorization?
intermediate
- If a user tries to access a protected API route without sending a login token, should the API return a 401 or 403 status code?