Authentication interview question · Most asked
What is the difference between authentication and authorization?
Summary
Authentication (authN) verifies who you are; authorization (authZ) decides what you're allowed to do. Authentication happens first and produces an identity; authorization uses that identity (plus roles, attributes and context) to allow or deny each action.
Longer Answer
Logging in with a password or passkey is authentication; checking whether that user may delete an invoice is authorization. HTTP status codes reflect the difference: 401 Unauthorized means 'not authenticated' (despite its name), 403 Forbidden means 'authenticated but not allowed'. Authorization must be enforced on every request on the server, close to the data.
Key Points
- AuthN = identity
- AuthZ = permissions
- 401 vs 403
- Enforce authZ server-side on every request
Explanation
What interviewers look for
Precise definitions plus the 401/403 nuance.
More most-asked Authentication questions
- Compare session-based authentication with token-based (JWT) authentication.
- What are the most common JWT security pitfalls?
- What are OAuth 2.0 and OpenID Connect, and how do they differ?
- Explain the OAuth 2.0 Authorization Code flow with PKCE.
- How do refresh tokens work, and how do you secure them?
- How should passwords be stored?
- What is multi-factor authentication, and which factors are strongest?
- How do you secure session cookies?