-
Book Overview & Buying
-
Table Of Contents
React Application Architecture for Production - Second Edition
By :
Authentication tells us who users are, but authorization determines what they can do. These are two different concepts that work together. Authentication answers "Are you who you say you are?" while authorization answers "Are you allowed to do this action?"
For example, authentication lets us know that a user is logged in as John. Authorization then determines whether John can edit a particular idea. Maybe John can only edit his own ideas, not ideas created by other users. This kind of permission checking is authorization.
Without authorization, authenticated users could perform any action in the application. They could delete other users' content, modify data they don't own, or access features they shouldn't have access to. Authorization rules define the boundaries of what each user can do.
In our application, we need authorization for several scenarios: