As we begin our exploration of security with JavaScript, it's important to understand the vital difference between authentication and authorization. In a nutshell, authentication is a process whereby a system affirms and acknowledges that you are who you say you are. Think of going to the store to buy a bottle of wine. You may be asked to provide identification that proves you are of or above the legal consumption age of your locale. The clerk has authenticated you with your photo ID to say that yes, you are you because I, the clerk, have matched your face to the photo in the I.D. A second case is when you fly on an airline. When you pass through security, they're also going to check your ID for the same reason: are you who you say you are?
These two use cases end, however, with authorization. Authorization says: I know you are who you say you are. Now, are you allowed to do what you want? In our wine example, if you are above the age of 21...