Glossary
Every term the courses use, defined in one line and then in a paragraph. Written to be read out of order.
Showing 2 of 2 matching “Authorization”
Establishing who someone is.
Proving identity: a password, a magic link, a sign-in with another provider. Distinct from authorization, which is about permission. Getting these confused is the source of a very common security hole.
See also Authorization, Session, OAuth
Deciding whether someone may do a thing.
Checking permission for a specific action on a specific record. Must be checked on the server, per request, per record. Being logged in is not permission to view record 41 just because you asked for it.
See also Authentication, IDOR