Authentication Vs Authorization FAQ & Answers

Authentication methods: (1) Something you know - password, PIN, security questions (weakest alone), (2) Something you have - hardware token, smartphone TOTP app, smart card, email/SMS code, (3) Something you are - biometrics (fingerprint, face recognition, iris scan), (4) Somewhere you are - geolocation, IP address (supplementary). Multi-Factor Authentication (MFA): Combines 2+ methods from different categories (password + TOTP = strong authentication). OWASP category: Identification and Authentication Failures (A07:2021).

Access control models: (1) RBAC (Role-Based) - users assigned roles (admin, editor, viewer), roles have permissions. Example: user 'alice' has role 'admin' → can access /admin/users, (2) ABAC (Attribute-Based) - permissions based on attributes (department, time, IP). Example: allow if user.department == resource.department AND time >= 9am, (3) ACL (Access Control Lists) - permissions attached to resources. Example: document 'report.pdf' allows ['alice', 'bob'] to read, (4) Permission-based - granular permissions (users.create, users.delete, posts.publish).

Authorization vulnerabilities (OWASP A01:2021 - #1 risk, affects 94% of applications): (1) IDOR (Insecure Direct Object References) - authenticated user accesses other users' data by changing ID (GET /api/users/123/profile, attacker changes 123 to 456), (2) Privilege escalation vertical - regular user gains admin privileges, (3) Privilege escalation horizontal - User A accesses User B's resources (same level), (4) Missing function-level access control - admin-only function exposed to all authenticated users (POST /api/admin/delete-user without role check).

Best practices (2025): (1) Authenticate first, authorize every request (never skip authorization after authentication), (2) Deny by default (explicitly allow access, reject everything else), (3) Never trust client-side checks (validate permissions server-side), (4) Use centralized authorization (single enforcement point via middleware/decorators), (5) Principle of least privilege (grant minimum necessary permissions), (6) Separation of duties (critical actions require multiple approvers). Example: Express.js requireAuth middleware (auth), requireRole('admin') middleware (authz).

Framework implementations: Spring Security - @PreAuthorize('hasRole(ADMIN)'), Django - @login_required (auth) + @permission_required('app.delete_user') (authz), ASP.NET Core - [Authorize(Roles = 'Admin')], Node.js Passport - passport.authenticate() (auth) + custom middleware (authz). Testing: Authentication (test credential validation, MFA bypass, session fixation, brute force), Authorization (test IDOR, privilege escalation, missing access controls, horizontal/vertical violations).