Authentication

When you log into any services, you are interacting with two fundamental security mechanisms:

Authentication
Authorization

Although these two terms are often used together, they solve different security problems.

A Simple Way to Understand the Difference

A common way to remember the difference is:

Authentication: Who are you?
Authorization: What are you allowed to do?

Example scenario:

You log into a banking application.

The system verifies your identity using your username and password. This is authentication.

After login, the system determines what actions you can perform:

• View balance
• Transfer money
• Access admin panel

This is authorization.

Authentication (AuthN)

Authentication is the process of verifying the identity of a user, system, or service.

The goal is to answer:

Is this user really who they claim to be?

Authentication typically happens first before any authorization decisions are made.

Authorization

Once a user is authenticated, the system must determine:

What resources can this user access?

This is the job of authorization.

Authorization defines permissions and access control rules.

Example roles:

Admin
Editor
User
Guest

Each role has different permissions.

Example Authorization Scenario:

Consider an admin dashboard.

User roles:

Admin
Manager
User

Permissions:

Authentication verifies identity.

Authorization enforces access rules.

Session Management

When you log into any platforms, something interesting happens.

You enter your username and password only once, but after that you can browse the entire website without logging in again on every page.

For example:

Login -> Dashboard -> Profile -> Settings -> Messages

Even though every page request goes to the server separately, the system remembers that you are already logged in.

Have you ever wondered how this works?

This answer lies in session management.

The Problem: HTTP Is Stateless

The web is built on HTTP, which is stateless protocol.

Stateless means:

Each request is independent

Example:

Request 1 -> Login
Request 2 -> Open Profile
Request 3 -> View Messages

From the server's perspective, these are three completely separate requests.

Without additional mechanisms, the server would not know:

Are all these requests coming from the same user?

This creates a major challenge:

How can a server remember a user after login?

Session management solves this problem.

What Is a Session?

A session is a temporary interaction between a user and a server.

It represents a logged-in user's state.

Example session information:

User ID
Login time
Permissions
Shopping cart
Preferences

Instead of re-authenticating the user on every request, the system maintains a session identifier.