Authentication answers “Who are you?” while authorization answers “What are you allowed to do?”
After authenticating a user, check their role or permissions before protected operations such as deleting users or changing billing settings.
Deep dive
Role-based authorization
Simple applications may use roles such as user and admin. Larger systems often need permissions such as users.read, users.update, or reports.export.
Always enforce permissions on the server
Hiding an admin button in the frontend is not authorization. The backend must reject unauthorized requests even if a user manually calls the endpoint.
ADVERTISEMENT