Level 2 · 2A Permissions and roles · Lesson 1 of 2
Who you are and what you can do
A system asks two different questions. The first: who are you? That's authentication (for example, logging in with a username and password). The second: what are you allowed to do? That's authorization. Almost every flaw in this level comes from mixing them up or forgetting the second one.
A role is a group of permissions: a "user" can see their own stuff, an "administrator" can change almost everything. The golden rule is least privilege: each person and each program has only the permissions they need, not one more. If a cleaning worker has the key to the safe, that rule was broken.
Once you log in, the system opens a session: it remembers that you already identified yourself and doesn't ask for your password on every click. That's why a stolen session is worth as much as the password itself.
Going deeper
Two classic mistakes
Authenticating without authorizing: the system knows who you are but doesn't check whether you can do what you're asking (any logged-in user can delete someone else). And authorizing with data from the client: trusting a "role" field sent by the browser, which anyone can edit.
Review questions
Logging in to a website with your username and password is an example of...
Answer: Authentication. Authentication is checking who you are. Authorization is deciding what you can do once you're in.
A cleaning worker has the key to every office, including the safe. Which principle was broken?
Answer: Least privilege. Each person should have only the permissions they need for their job, not one more.
What is a session?
Answer: What remembers you already identified yourself, so you aren't asked for your password on every click. That's why you have to protect the session (and the cookie that identifies it): whoever steals it gets in as you.