من أنت مقابل ما المسموح لك

في هذا الدرس

separate authentication from authorization.

الموضوعات المخطط لها

• Authentication answers "who are you?" (login, token). Failing it gives 401.
• Authorization answers "what may you do?" (roles, ownership). Failing it gives 403.
• Authentication comes first; authorization uses its result.
• Example: a customer can read their own orders (allowed) but not another customer's (forbidden).
• Check authorization on the server for every request; never trust the client to hide buttons.