All 15 Authentication & Authorization questions
More in Authentication & Authorization
How should passwords be securely stored in a Node.js application's database, and why is bcrypt commonly used? What is the difference between storing an authentication token in localStorage versus an httpOnly cookie, from a security perspective? How does session-based authentication work in a Node.js/Express application, and what does the session store need to handle? What is a JSON Web Token (JWT), and what are its three parts? What is Passport.js, and how do its 'strategies' provide a consistent authentication abstraction across different methods? What is Role-Based Access Control (RBAC), and how would you implement it as Express middleware? What is CSRF (Cross-Site Request Forgery), and how do you protect a Node.js session-based application against it? How do you implement email verification and password-reset flows securely in a Node.js application? How would you implement Attribute-Based Access Control (ABAC) in a Node.js application when RBAC roles aren't expressive enough? How do you implement JWT refresh token rotation in a Node.js API, and why is it more secure than a single long-lived token?
Advertisement
Node.js › Authentication & Authorization

What is the difference between authentication and authorization in a Node.js application?

Beginner

Answer

Authentication verifies who a user is -- confirming their identity, typically through a username/password, a token, or a third-party identity provider. Authorization determines what an already-authenticated user is allowed to do -- which resources they can access and which actions they can perform. A request must always be authenticated before it's meaningful to authorize it, but a user can be successfully authenticated and still be denied authorization for a specific action.
// Authentication: verifying identity
app.post('/login', async (req, res) => {
  const user = await verifyCredentials(req.body.username, req.body.password);
  if (!user) return res.status(401).json({ error: 'Invalid credentials' });
  req.session.userId = user.id;
});

// Authorization: checking permission for an already-authenticated user
app.delete('/posts/:id', requireAuth, (req, res) => {
  if (req.user.role !== 'admin') return res.status(403).json({ error: 'Forbidden' });
  deletePost(req.params.id);
});
Real-world example A blogging platform lets any logged-in (authenticated) user comment on posts, but only lets users with the 'editor' or 'admin' role (authorization) actually delete or edit other users' posts, checking these as two clearly separate steps in the request pipeline.

Common follow-ups: What HTTP status codes are conventionally used to distinguish an authentication failure from an authorization failure?;How does session-based authentication differ architecturally from token-based authentication?

Authentication & Authorization (JWT OAuth Passport);Security
All 15 Authentication & Authorization questions