Authentication vs authorization vs RBAC?
Practice this questionWANT TO UNDERSTAND THE CONCEPT FIRST?Learn Authentication vs authorization vs RBAC?
Definition:
Authentication checks the caller's identity, authorization decides whether that identity may perform an action, and RBAC groups permissions into roles. These checks work together but answer different questions. A logged-in employee should not automatically gain access to every employee's records.
Key points:
-
Authentication checks identity; authorization checks access.
-
RBAC assigns permissions through roles.
-
Also check record ownership and tenant boundaries on each protected operation.
-
Use record ownership or tenant scope in addition to broad roles, and deny access when the relevant rule cannot be established.
Comparison:
| Point | Authentication | Authorization |
|---|---|---|
| Question | Who is the caller? | May this caller do this? |
| Example | Verify a login/session/token | Verify ownership of an order |
| Typical failure | 401 for missing/invalid credentials | 403 for known but disallowed access |
| Checked only at login | No; requests need identity context | No; check each protected operation |
- Some APIs use 404 instead of 403 to avoid revealing that a protected resource exists.
Interview point:
- Give an example where authentication succeeds but authorization fails, such as a normal user calling an admin endpoint.
Adapted from 08_PERFORMANCE_SECURITY.md · “Authentication vs authorization vs RBAC?”. Code examples are study fragments. Difficulty and core labels are editorial estimates; version-specific behavior should be checked against your project.