Security, Responsiveness, and Mobile

Authentication and authorization are related but distinct concerns in a web application. Authentication answers the question of who a user is, typically through a password, a one-time code, or a third-party identity provider via a protocol like OAuth, and it usually results in some form of session or token that lets the application recognize the same user on subsequent requests without asking them to log in again for every action. Authorization, by contrast, answers what that authenticated user is allowed to do, checking permissions or roles before granting access to a specific resource or operation. Getting the two right matters well beyond user convenience: an application that authenticates correctly but fails to check authorization on every relevant request can let a legitimate, logged-in user access or modify data that belongs to someone else, which is one of the more common categories of real-world security failure.