Concept

AuthN vs AuthZ — Two Distinct Processes

Authentication (AuthN) — "Who are you?"

Authentication verifies identity. It is the process of proving you are who you claim to be. You cannot be authorized for anything until you have first been authenticated.

Authentication is based on: something you know (password, PIN), something you have (phone for OTP, hardware token), or something you are (fingerprint, face ID).

Two Dominant Authentication Patterns

Session-Based Authentication (stateful): After login, the server creates a session record, stores the session ID in its own database, and returns it to the client as a cookie. Every subsequent request sends the cookie; the server looks up the session to identify the user.

  • Pros: Simple; sessions can be instantly invalidated (log the user out by deleting the server-side record).
  • Cons: Stateful — every server must have access to the session store. Requires a shared session database (typically Redis) in a horizontally scaled system.

Token-Based Authentication — JWT (stateless): After login, the server generates a signed JSON Web Token containing the user's identity and permissions. The token is returned to the client. Every subsequent request includes the token in the Authorization header. The server validates the signature — no database lookup required.

  • Pros: Stateless — any server can validate any token without shared state. Scales horizontally with no coordination.
  • Cons: Tokens cannot be easily invalidated before expiry. A stolen token is valid until it expires. Mitigation: short expiry times (15 minutes) combined with a refresh token mechanism.

Authorization (AuthZ) — "What are you allowed to do?"

Authorization determines what an authenticated identity is permitted to access. It answers: can this user read this resource? Can this service call this endpoint?

Role-Based Access Control (RBAC) — Users are assigned roles (Admin, Editor, Viewer). Roles are assigned permissions. Authorization checks: does this user's role include the required permission? Simple to manage at small scale; becomes complex when roles proliferate.

Attribute-Based Access Control (ABAC) — Authorization is based on attributes of the user, the resource, and the environment. A policy might read: "Allow if the user is the document owner AND the request originates from a corporate IP AND it is during business hours." More flexible and expressive than RBAC; significantly more complex to implement.