Authentication vs Authorization

These two words look similar but do completely different things. Every login system uses both — understanding them helps you build and debug web apps correctly.

Authentication — "Who are you?"

Authentication verifies your identity. It answers: are you really who you claim to be?

When you log into a website with your email and password — that's authentication. The system checks if your credentials are correct.

Examples: - Login with email + password - OTP on your phone - Face ID / Fingerprint - Google Sign-In (OAuth)

If credentials are wrong → access denied. If correct → you're authenticated.

Authorization — "What can you do?"

Authorization decides what you're allowed to access after you're logged in.

Same website, same login — but an admin sees a delete button that a regular user doesn't. That's authorization controlling what each role can do.

Examples: - Admin can delete users, regular user cannot - Student can view courses, teacher can create them - Editor can publish articles, viewer can only read

The Key Difference

How They Work Together

User enters email + password
        ↓
Authentication → verifies identity
        ↓
Authorization → checks what they can access
        ↓
User sees only what they're allowed to see

Simple Analogy

Think of a hotel:

• Authentication = Showing your ID at check-in to prove who you are
• Authorization = Your room key only opens your room, not every room

You proved your identity (authentication). The system then decides what you can access (authorization).

Why This Matters for Developers

When building a web app:

• Authentication → handled by login system (Flask-Login, JWT, OAuth)
• Authorization → handled by role checks (if user.is_admin, middleware, decorators)

A common bug: authenticating users but forgetting to check authorization — so any logged-in user can access admin pages.

Next Step

👉 Learn how HTTPS protects your login data