authorization · authz
/ aw-ther-i-ZAY-shun /
Authorization decides WHAT you're allowed to do, once the system already knows who you are. You've logged in — fine — but can you delete this file? View someone else's salary? Open the admin panel? Authorization is the gatekeeper that answers each of those.
It always comes after authentication. First the system confirms your identity (authn), then it checks your permissions (authz). Knowing who you are tells it nothing about what you may touch — a logged-in guest and a logged-in admin are equally 'authenticated' but very differently 'authorized'.
When you hit a wall you can't pass, that's usually an authorization failure: the server knows exactly who you are, it just won't let you do that. On the web it often shows up as a 403 Forbidden.
if (user.role !== "admin") {
return res.status(403).send("Forbidden");
}
// authenticated, but not authorized for thisAuthorization check: we know who you are, you're just not allowed in here.
401 Unauthorized actually means 'we don't know who you are' (an authentication problem) — it's 403 Forbidden that's the true authorization 'no'. A naming mix-up the web never fixed.