CodeParkAuthentication proves who is asking. The server checks credentials, such as a password, a session cookie or a signed token. Then it concludes: this request comes from user 42.
Authorization comes next. It decides if user 42 may do this specific action on this specific resource, for example DELETE /invoices/981.
Authentication comes first, because you can't decide permissions without knowing who is asking.
What happens when each one fails:
- Failed authentication usually returns 401. It asks the client to log in or send valid credentials.
- Failed authorization returns 403.
- Or it returns 404 when you don't want to reveal that the resource exists.
They are separate jobs. A user can be fully authenticated and still be refused. The server must check authorization on every request, not only at login.
- Authentication answers the question "who are you?".
- Authorization answers the question "what may you do on this resource?".
- Authentication happens first, because authorization needs an identity.
- A failed authentication returns 401, and a failed authorization returns 403 (or 404 to hide that the resource exists).
- The server checks authorization on every request.
Read more