Authenticating and Authorizing Requests
Most projects need to restrict access to features; otherwise, anyone who knows an application’s URL can execute any operation. This is currently how the example application is set up: anyone who can request http://localhost:5000 will be able to store and delete data, regardless of who they are.
Authorization, often referred to as AuthZ, is the process of restricting access so that operations can only be performed by some users – known, naturally enough, as authorized users. Authentication, often referred to as AuthN, is the process of a user identifying themselves so that the application can determine whether the user is authorized for the operations they request. This chapter explains how Node.js applications can apply authentication and authorization, building on the features described in earlier chapters. Table 15.1 puts this chapter in context.
Table 15.1: Putting authorization and authentication in context
