Ravi Sir's Cyber Security Cards › Comparison Cards
Authentication vs Authorisation
Authentication vs Authorisation Authentication : proving who you are . Example: password, OTP, fingerprint. Authorisation : deciding what you may do after login. Example: see only your own orders. Authentication comes first . Authorisation comes next , on every request. Easy memory: AuthN = who , Au
Read card text
What this card says
What each one is
Authentication: proving who you are. Example: password, OTP, fingerprint.
Authorisation: deciding what you may do after login. Example: see only your own orders.
Order
Authentication comes first. Authorisation comes next, on every request.
Easy memory: AuthN = who, AuthZ = what.
Example: online shop
Ravi logs in with password + OTP → authentication passed.
Ravi changes the URL from order 1001 to 1002 (Priya’s order). The site must say No → authorisation.
When it fails
If the site shows Priya’s order, that is IDOR (Insecure Direct Object Reference).
It is an authorisation failure, even though the login was valid.
Learn more in the lesson: 47.7 OWASP / Web / Email Auth (SPF DKIM DMARC)