身份验证与授权详解

Every login and every protected feature runs a security check behind the scenes. It rests on two ideas: authentication and authorization.

Think of a building: first you prove who you are, then your role decides which rooms you can enter. That's authentication (AuthN) versus authorization (AuthZ).

Authentication verifies that you are who you claim to be — the question "are you really you?" Fail it, and access is denied before anything else happens.

You hit authentication daily: passwords you know, biometrics like a fingerprint, one-time codes from an app, or digital certificates.

Once you're in, authorization decides what you're allowed to do — the question "which resources and actions are you permitted?"

In an online store, a customer browses and buys; an admin can also add products and view reports. Your role and permissions set the boundary.

Picture a club: the bouncer checking your ID is authentication; your membership tier deciding if you reach the VIP lounge is authorization.

Order matters: authentication always comes before authorization. You can't decide what someone may do until you know who they are.

Neither works alone: authentication without authorization knows who you are but not your access; authorization needs an identity to grant anything. Together they're a security barrier.

Consider a user trying to access a secure document on a server.

Recap: authentication answers "who are you?" and authorization answers "what can you do?" — the bedrock of secure access. Next: how identity management evolved.