Web Security / Thinking like a defender
Lesson 3 of 27
Authentication vs authorisation
Authentication checks who you are (login). Authorisation checks what you're allowed to do. Many breaches happen when a site checks the first but forgets the second.
Key points
- AuthN: who are you?
- AuthZ: are you allowed?
- Check both on every request
Quiz · +10 XP
Checking whether a logged-in user may delete a post is:
Log in to save progress and earn XP.