Who are you vs what may you do
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
separate authentication from authorization.
Planned topics
- Authentication answers "who are you?" (login, token). Failing it gives
401. - Authorization answers "what may you do?" (roles, ownership). Failing it gives
403. - Authentication comes first; authorization uses its result.
- Example: a customer can read their own orders (allowed) but not another customer's (forbidden).
- Check authorization on the server for every request; never trust the client to hide buttons.
Draft outline details
Demonstration
| Situation | Status |
|---|---|
| No token | 401 |
| Valid token, wrong role | 403 |
| Valid token, allowed | 200 |
Check your understanding
Which status for a logged-in user who is not allowed?
Show answer
403.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.