ASP.NET Core Web API Interview Question #53

What is the difference between authentication and authorization?

Authentication, Authorization, JWT & API Security Mid-Level Intermediate

Quick Interview Answer

Authentication verifies or establishes the caller's identity, while authorization determines what that identity is permitted to do. Authentication generally happens before authorization.

Detailed Explanation

Authentication verifies or establishes the caller's identity, while authorization determines what that identity is permitted to do. Authentication generally happens before authorization.

A valid token can therefore authenticate a user successfully while the request still receives 403 Forbidden because the user lacks the permission required by the endpoint.

Code Example

// Authentication: Who are you?
[Authorize]

// Authorization: Are you allowed to do this?
[Authorize(Policy = "CanManageProducts")]