How does authentication differ from authorisation?
Answer out loud or in your head first, then compare.
Answer
Authentication confirms who the user is. Authorisation checks what that person may do and which data they can access. Being logged in doesn't automatically give the right to every document or every project.
Example: I know Anna has logged in, but I still have to check whether Anna may see an HR document. The backend shouldn't take identity from an arbitrary form field or an argument generated by a model. The token must be checked too: is it valid and intended for our API? These rules apply to reading, exporting, job status and performing actions, not just the main screen.
Why it matters: The foundation of security in systems for employees.
Possible follow-ups: Why isn't hiding a button in React enough?
How did it go? Be honest — “Not yet” puts the question on your review list.
Start with
- D-P01 · What is HTTP, and what do a request and a response look like? — Backend, data and system design
- D-P10 · What is a database transaction? — Backend, data and system design
- D-P13 · What is a message queue, and why do we use one? — Backend, data and system design
Related questions
- Authentication and permissions — Node.js
Practise in code
- Approving a specific proposal — runs tests in your browser
Further reading
- Microsoft Graph: Overview of permissions(opens in a new tab)Docs; accessed 22.10.2026. Delegated and application permissions, and the limits of access.