Auth Series #1: Understanding Authentication and Authorization

#authseries #express #javascript #backend

Authentication and Authorization are two of the most essential features in modern web applications.
Signup and login systems have become common in most real-world apps from small personal projects to production-ready enterprise solutions. These mechanisms ensure that users enjoy a secure and personalized experience on the platform.

From the USER'S Perspective :

❖ You get your own secure space within the application.
❖ You have control over your own data and actions. No one else can access or modify them.

From the Developer / PLATFORM'S Perspective :

❖ You offer users a smooth, personalized experience that builds trust.
❖ You protect your platform's data from unauthorized access or malicious activity.

These are the reasons that makes the Authentication and Authorization a powerful feature that a web application can have.

1. Understanding Authentication and Authorization

📌 What is Authentication?

Authentication is the process of verifying the identity of a user. It usually involves collecting user credentials such as email, username or passwords and validating them against stored records in database.

In simple terms, it's the process that answers:

"Who are you?"

This step is often implemented through actions like Sign Up(Register) and Sign In(Login).

📌 What is Authorization?

Authorization, on the other hand, determines WHAT a user is allowed to do after the have been authenticated.

It answers:

"What are you allowed to access?"

For example an author of a blog post can modify or delete the post, while a regular user can only view the post.

How they work together in a real-world flow :
⤷ The user enters credentials (Sign Up/Sign in)
⤷ The system authenticates them (verifies identity)
⤷ The system authorizes their actions (decides what they can access or modify)

Now we have the basic theoretical understanding of these two terms.
Let's discuss about how it can be implemented in Express.js.

Previous : Auth Series Index: Building Authentication and Authorization in Express.js
Next : Auth Series #2: Authentication Implementation with Passport.js