Start Learning
Javaneer
Back to stage
Module 4·Security

Authentication vs Authorization

Who you are versus what you're allowed to do - the two distinct questions every secure app must answer.

12 min readBeginner
On this page

Two words that sound alike, get shortened to the same "auth," and are constantly confused - yet they answer completely different questions. Getting them straight is the foundation of every security decision you'll make.

  • Authentication — Who are you? Proving identity.
  • Authorization — What are you allowed to do? Granting permission.

Authentication always comes first: you can't decide what someone may do until you know who they are.

The passport and the boarding pass

At the airport, your passport proves who you are - that's authentication. Your boarding pass says which flight and seat you may board - that's authorization. The passport doesn't get you onto a plane, and the boarding pass is meaningless without the passport to back it up. You show the passport first, then the boarding pass grants access to a specific gate.

In Spring Security terms

After authentication succeeds, Spring stores an Authentication object in the SecurityContext. It carries:

  • the principal (who - e.g. the username/email), and
  • a set of GrantedAuthority values (what they can do - e.g. ROLE_MEMBER, ROLE_LIBRARIAN).

Authorization then checks those authorities against the rule for the request:

// authorization rules, expressed against authorities
.requestMatchers(HttpMethod.POST, "/api/books").hasRole("LIBRARIAN")   // what you may do
.requestMatchers("/api/books/**").authenticated()                       // just be known

Roles vs authorities

A role is just an authority with a ROLE_ prefix by convention. hasRole("LIBRARIAN") checks for the ROLE_LIBRARIAN authority. Roles are coarse ("librarian", "member"); finer-grained authorities (book:delete) let you express precise permissions. Both are just strings the authorization layer matches.

Model permissions, not just people

Assign authorities to represent capabilities, then grant those to users via roles. It keeps rules readable (hasRole('LIBRARIAN')) and lets you change who can do what without touching every endpoint.

Which is which?

Label each as authentication or authorization:

  1. BookVault verifies a login email and password.
  2. BookVault checks that the caller has ROLE_LIBRARIAN before deleting a book.
  3. A JWT's signature is validated to confirm the caller's identity.
  4. A MEMBER is blocked from an admin-only endpoint.

Which correctly describes authentication and authorization?

Key takeaways

  • Authentication answers 'who are you?'; authorization answers 'what may you do?'.
  • Authentication always comes first - permissions are meaningless without a known identity.
  • After login, Spring stores an Authentication (principal + GrantedAuthorities) in the SecurityContext.
  • A role is an authority with a ROLE_ prefix; hasRole('LIBRARIAN') checks for ROLE_LIBRARIAN.
  • Model capabilities as authorities and grant them via roles to keep access rules readable and flexible.
Was this lesson helpful?
Edit this page on GitHub