Node.jsQuestion 18 of 26
Authentication and permissions
Answer out loud or in your head first, then compare.
Answer
Authentication establishes who the user is. Authorization checks what that person is allowed to do.
Example: a successful login confirms Anna's identity, but doesn't give her the right to read another customer's order.
On the server I check both the session and the permissions for the specific operation and resource. A “user” role alone doesn't decide who owns a document.
Statuses: 401 usually means missing valid authentication; 403 means the operation is refused.
Pitfall: a hidden button in the UI doesn't protect the API. A JWT has to be verified, not just decoded.
How did it go? Be honest — “Not yet” puts the question on your review list.
Related questions
- D08 · How does authentication differ from authorisation? — Backend, data and system design