Backend Python interview: explain authN vs authZ.

Summary

Authentication proves who the user or service is; authorization decides what that identity is allowed to do.

Longer Answer

Authentication uses credentials or tokens such as passwords, OAuth flows, API keys, mutual TLS, or session cookies. Authorization applies policies such as roles, permissions, ownership checks, scopes, attributes, or relationship-based access.

A common production bug is authenticating a user and then forgetting object-level authorization. Every sensitive operation should check both the identity and whether it can access the specific resource.

Key Points

• Authentication uses credentials or tokens such as passwords, OAuth flows, API keys, mutual TLS, or session cookies
• Authorization applies policies such as roles, permissions, ownership checks, scopes, attributes, or relationship-based access
• A common production bug is authenticating a user and then forgetting object-level authorization
• For 'Backend Python interview: explain authN vs authZ.', a strong interview answer should define the mechanism, name the common failure mode, and explain the production decision it affects.

A common production bug is authenticating a user and then forgetting object-level authorization. Every sensitive operation should check both the identity and whether it can access the specific resource

Comparison / Tradeoffs

A common production bug is authenticating a user and then forgetting object-level authorization. Every sensitive operation should check both the identity and whether it can access the specific resource. |

Summary

Authentication proves who the user or service is; authorization decides what that identity is allowed to do.

Longer Answer

For 'Backend Python interview: explain authN vs authZ.', a strong interview answer should define the mechanism, name the common failure mode, and explain the production decision it affects.

A common production bug is authenticating a user and then forgetting object-level authorization. Every sensitive operation should check both the identity and whether it can access the specific resource.

Key Points

• For 'Backend Python interview: explain authN vs authZ.', a strong interview answer should define the mechanism, name the common failure mode, and explain the production decision it affects
• A common production bug is authenticating a user and then forgetting object-level authorization
• Every sensitive operation should check both the identity and whether it can access the specific resource
• Use the answer to connect the concept back to a realistic production or interview scenario for 'Backend Python interview: explain authN vs authZ.'

Comparison / Tradeoffs