Tools / Cyber Security Interview Questions
What is the difference between Authentication and Authorization?
| Authentication | Authorization |
| Confirms who you are | Confirms what you're allowed to do |
| Happens first, at login | Happens after authentication, on every access request |
| Example: entering a username and password | Example: checking if that user can access the admin panel |
| Failure results in access denied, invalid credentials | Failure results in access denied, insufficient permissions |
A useful way to remember the distinction: authentication answers who are you, authorization answers what are you allowed to do now that we know who you are. OAuth 2.0, for instance, is fundamentally an authorization framework, while OpenID Connect layers authentication on top of it.
Which process confirms a user's identity?
Which framework is fundamentally about authorization?
More Related questions...
