Authorization & Identity

The same request asked twice: first whether you are really you, then whether the thing you’re asking for is actually yours.

Before you start. Authentication proved who is asking, a token that says “this really is you”. This lesson answers the harder question that token can’t: now that the system knows who you are, what are you actually allowed to touch?

The idea in 30 seconds

Authentication proves who you are; authorization decides what you may touch, and skipping that second check is the single most common way real systems leak data.
A program with more access than you can be fooled into using that access on your behalf without checking who actually asked; that mistake is called a confused deputy.
A check that only verifies “is this a valid login” and never verifies “does this specific thing belong to this specific user” lets anyone read anyone else’s data just by changing an id; that bug is IDOR.
Making ids hard to guess buys time. It never replaces the check that the item belongs to the person asking for it.
OAuth lets an app get permission for one slice of your account, like your photos, without your password ever leaving your own login page.
What OAuth hands an app proves what it may do, not who is holding it; OIDC is the separate layer that proves your identity to the app.

Read the story · Skip to the numbers