Authorization and Authentication

Hello..!!!

Lot of times we see  warning message saying "You are not Authorized to use this " or "Authenticate yourself to download this file"

These two words may confuse us bit because they are too similar to write and pronounce. All the services or APIs will go under Authorization and Authentication steps in order to give access to the resources.Let's dig deep into it.

So, will discuss below in this article

• What is Authentication and Why 
• What is Authorization
• An Example to differentiate them

What is Authentication

Yes..!! Authentication is a process of verifying who you are. Generally if we visit any e commerce site or social network site, we will be prompted to Sign In/Login with a UserID/Username and Password. Sometimes it could ask for mobile number to verify you through OTP 

If you are failed in Authentication process you are not even allowed to see the home page in some web applications(so sad). This process comes under security verification

Today we save a lot of sensitive data(Bio data , photos, documents etc) in online portals. Any one can pretend to be you and access your personal info on the web site and may misuse it. This looks small but when it comes to a big aspect of data, Authentication plays a big roll in security point of view

We have to prove ourselves that we are valid user to use the portal/web site. As said earlier others may pretend to be you and can login to the application. So, to avoid this there are different types of authentications that are followed by lot of applications

Single(One) factor authentication

As the name itself indicates , it takes only one factor or credential to prove the identity of the user to be able to use the resources of the application

Generally this will be a password which was given by the user while registering for that web site. Some times this password may be auto generated by the application itself. Some systems will ask us to solve a  CAPTCHA(Completely Automated Public Turing test to tell Computers and Humans Apart.. very short full form 👀👀 ) to prevent the resources to be used by Automated Systems. But nowadays hackers can easily pass in this with distinction marks.

Hackers can also crack password trying all the combination of the letters, words, symbols for each length of the password

To overcome this and to increase the work load for hackers, most of the applications consider  another factor of authentication to identify the user

Two factor authentication

Along with the password, application will ask user to set another factor which is uniquely identified by the end user. This depends on the application, some apps ask for security question and the answer to be set while sign up process.

What is your favorite color ? ☝
What is your crush name ?💖
Whom will you murder if you get a chance to?👅💪💣

This list goes on. Main problem with this is, user himself will forget the answer

Some Applications goes for OTP authentication to login the portal. This is more secured and most  commonly used by lot of applications.

These factors may be more in some secured applications to make sure the user is the one who claimed to be the valid user with the given combination of credentials on that applications, then it is called Multi Factor Authentication

What is Authorization

Well, we have logged into the application successfully. But then we will be provided with a set of resources/features to be used. Permissions on these resources will be decided by the system based on some criteria which is internal to the application

Yes.. Based on the role in that application, we will be given with the permissions. So, Authorization is the ability to access the system resources such as files, database, photos, documents, etc to read/write/execute them

Generally admin users will have most of the rights to access the features to have the control over the application. 

A Dream travel to Bangkok

Suppose, we have decided to go to Bangkok(Most preferred) for a vacation . We need to travel on flight and booked tickets for window seats. There will be a Pilot who controls the flight. We on-boarded the flight and directly went to the flight controls cabin and tried to drive it with 120 kmph speed like Dhoom🚅🚅.. But suddenly we were kicked out of the flight with the same speed 🚤🙌.. 

Here, both of us has to prove our identity to enter the flight, but we as passengers are not allowed to the cabin. Here both rolls were Authenticated but we are not Authorized to enter the cabin to control the flight but the Pilot does

Hope you got the clear difference between the Authentication and Authorization

Thanks...!!!
The Midnight Coder