authorization

Authorization controls access within software. Once a system knows who or what is making a request, it checks whether the requested action is allowed. That might mean viewing a record, changing an order or managing users.

How does authorization work?

An application defines access rules as permissions or roles. A customer service employee might be allowed to view orders, while only an administrator can change user accounts. For every protected request, the application checks the requested action against the assigned permissions. If the user lacks the required permission, the application rejects the request.

Permissions can be assigned directly to an account, but are usually based on a role or attributes such as department, organization and data ownership. Granting only the permissions someone needs for their work limits the potential damage from a mistake or compromised account. Hiding a button in the user interfaceGlossary · In briefuser interfaceA user interface (UI) is the part of a digital system through which a user receives information and operates it. Examples include screens, buttons, forms and voice controls.Read more is not enough: the server must also check each request.

Authorization and authentication

AuthenticationGlossary · In briefauthenticationAuthentication is the process by which a system verifies the claimed identity of a user, device or application.Read more and authorization often follow each other, but serve different purposes. Authentication establishes who is signing in, for example using a password and a second factor. Authorization then determines what that user may do.

A signed-in user is therefore not automatically authorized to use every part of an application. For sensitive data, the software must check each request to determine whether the user may access that specific data or perform that action.