Authentifizierung vs. Autorisierung
Wer du bist gegenüber was du darfst - die zwei Fragen, die jede sichere App beantworten muss.
Deutsche Übersetzung in Arbeit
Diese Lektion ist noch nicht ins Deutsche übersetzt und wird daher auf Englisch angezeigt. Der Rest der Seite ist vollständig lokalisiert.
Auf dieser Seite
Two words that sound alike, get shortened to the same "auth," and are constantly confused - yet they answer completely different questions. Getting them straight is the foundation of every security decision you'll make.
- Authentication — Who are you? Proving identity.
- Authorization — What are you allowed to do? Granting permission.
Authentication always comes first: you can't decide what someone may do until you know who they are.
At the airport, your passport proves who you are - that's authentication. Your boarding pass says which flight and seat you may board - that's authorization. The passport doesn't get you onto a plane, and the boarding pass is meaningless without the passport to back it up. You show the passport first, then the boarding pass grants access to a specific gate.
In Spring Security terms
After authentication succeeds, Spring stores an Authentication object in the
SecurityContext. It carries:
- the principal (who - e.g. the username/email), and
- a set of
GrantedAuthorityvalues (what they can do - e.g.ROLE_MEMBER,ROLE_LIBRARIAN).
Authorization then checks those authorities against the rule for the request:
// authorization rules, expressed against authorities
.requestMatchers(HttpMethod.POST, "/api/books").hasRole("LIBRARIAN") // what you may do
.requestMatchers("/api/books/**").authenticated() // just be knownRoles vs authorities
A role is just an authority with a ROLE_ prefix by convention. hasRole("LIBRARIAN")
checks for the ROLE_LIBRARIAN authority. Roles are coarse ("librarian", "member");
finer-grained authorities (book:delete) let you express precise permissions. Both are
just strings the authorization layer matches.
Model permissions, not just people
Assign authorities to represent capabilities, then grant those to users via roles. It
keeps rules readable (hasRole('LIBRARIAN')) and lets you change who can do what
without touching every endpoint.
Label each as authentication or authorization:
- BookVault verifies a login email and password.
- BookVault checks that the caller has
ROLE_LIBRARIANbefore deleting a book. - A JWT's signature is validated to confirm the caller's identity.
- A MEMBER is blocked from an admin-only endpoint.
Which correctly describes authentication and authorization?
Key takeaways
- Authentication answers 'who are you?'; authorization answers 'what may you do?'.
- Authentication always comes first - permissions are meaningless without a known identity.
- After login, Spring stores an Authentication (principal + GrantedAuthorities) in the SecurityContext.
- A role is an authority with a ROLE_ prefix; hasRole('LIBRARIAN') checks for ROLE_LIBRARIAN.
- Model capabilities as authorities and grant them via roles to keep access rules readable and flexible.