Till now, in this entire course, we focused on how to authenticate an user, like how to protect
our API paths, URLs inside our application.
But security also has authorization involved. We hear a lot about authentication and authorization.
In this video
Let's try to clarify what is truly authentication and what his authorization before we move on to further
sections where we will be implementing restrictions, authorization inside our application. In authentication
the identification of the user will happen.
Suppose, as an application architect, if I want to secure my application in my login page, I will
ask my user, prove your identity like with your email address passwords and that's what authentication.
Whereas authorization means once I authenticated a person to come into my application, there might
be different roles, access rules that I might have defined, authorities that I might have defined
Like
This user should act like an admin.
This user should act like a normal customer.
So there are many terminologies that we call like some application.
They call it as supervisor, customer, user.
So based upon these authorities, roles, we should control what action a user should perform inside
our application.
That is authorization.
If we try to take any classic example, suppose I want to fly from one city to another city.
I book a ticket.
I went to airport at the very starting of the airport.
You have to authenticate yourself like what is your passport number?
Are you the same person who want to fly?
What is your
SSN details and they try to do like identify your identity and once you clear that authentication
step, then you will go to the place where you want to take your flight.
Like gate number one or two or three, whatever it might be.
So in this scenario, you proved your authentication.
That's where you're allowed to enter into the airport, but you are authorized to take the flight,
which you only booked.
Suppose I might have booked a flight to Mumbai, but at the last minute, if I want to travel to Delhi,
that's not authorized because I'm not authorized user.
I am authorized to take only Mumbai flight.
So that is an authorization.
If we take any real time example, usually authentication done before authorization, the very first
step that will happen inside any secure application or a secure scenario is authentication. Post authentication
is successful.
The authorization will happen to identify what authorities or roles that this person has. To perform authentication
We just need his login credentials like username, password, mobile number or multifactor authentication.
Once that user login successfully happen, then we look
what are his configured roles inside our database or any other system to derive his authorities?
If we get an any error due to invalid credentials in authentication, we get an 401 error
from server . 401 indicates authentication failure, whereas my authentication is passed, but I'm
not authorized to perform any action.
In that scenario
We'll get a 403 error, which is a forbidden error. Forbidden means it is hidded from you.
You're not allowed to perform that action.
And another example that we can take is inside any bank application.
First I have to prove my identity by logging credentials.
I may be a customer or an employee inside the bank. In any of these scenarios.
I have to prove my identity by giving my login correction's.
Once I entered proper login details, I am authorized into the system based upon the roles, authorities
configured inside the system.
So on a high level, this is authentication and authorization.
In the next video, let's try to see how spring security handles authentication and authorization internally.
Thank you
and Bye