Chapter 13: Understanding Authorization

One of the important aspects of building secure applications is to ensure that users have access only to resources that they need. In the real world, when you check in to a hotel, a front-desk employee validates your ID and credit card and assigns a key card to access your room. Based on the type of room you have chosen, you may have privileges such as access to the lounge, pool, or gym, among others. Here, the validation of your ID and credit card and assigning a key card is authentication, and permitting you to access the various resources is authorization. So, to explain it further, using a key card, we cannot identify who you are but can determine what you can do.

Authorization is a mechanism by which you determine what users can do and grant or deny access to a resource of your application. For instance, users of our e-commerce application should be able to browse products, add them to the cart, and check out to buy them, and only admin...