Take the 2-minute tour ×

What's the difference in web application? In short, please.

P.S. I see abbreviation "auth" a lot. Does it stands for auth-entication or for auth-orization? Or both?

share|improve this question
add comment

3 Answers

up vote 27 down vote accepted

Authorization refers to rules that determine who is allowed to do what. E.g. Adam may be authorized to create and delete databases, while Usama is only authorised to read.


The two concepts are completely orthogonal and independent, but both are central to security design, and the failure to get either one correct opens up the avenue to compromise.

In terms of web apps, very crudely speaking, authentication is when you check login credentials to see if you recognize a user as logged in, and authorization is when you look up in your access control whether you allow the user to edit, delete or create content.

share|improve this answer
add comment

As Authentication vs Authorization puts it:


  • Who is the user?


  • Is user X authorized to access resource R?
  • Is user X authorized to perform operation P?

See also:

share|improve this answer
No. They are two separate things. Authentication makes sure the user is who they say they are, while authentication ensures that the user has access. If you do authorization without authentication, anyone can just say they're an administrator, and they'd get administrator powers, no questions asked. –  Sebastian Paaske Tørholm Jul 2 '11 at 10:52
@daGrevis: No, and please please please, if you aren't 100% comfortable and conversational with those concepts, please don't make a public web app. –  Kerrek SB Jul 2 '11 at 10:57
@daGrevis: Your comment is completely wrong! Please reconsider what you wrote. It might lead newbies in a completly wrong direction. –  user619 Dec 15 '13 at 17:21
Yep, I know... now. Removed the comment to avoid confusion for newbies. –  daGrevis Dec 15 '13 at 19:22
add comment

In short, please. :-)

Authentication = login + password (who you are)

Authorization = permissions (what you are allowed to do)

Short "auth" is most likely to refer either to the first one or to both.

share|improve this answer
add comment

Your Answer


