Identify the person making the request.
Authentication checks who a person is. Authorization checks what that person may do. This lesson explains the first check.
Why this lesson?
A customer signs in to an order website. The website needs to verify who they are before checking access to an order.
Learning goal and prerequisites
Check the sign-in evidence
The person uses a sign-in method that the service supports, such as a password or passkey. The service checks the evidence. This example leaves out the details of that method so you can focus on the identity check.
Inspect request, response, and claims
Try a failure scenario
↳ Change a condition
Read the detailed explanation
Why it exists, how it works, and where it fits
An application cannot safely trust a name just because a browser sends it. Before it can protect private data or attach actions to an account, it needs evidence that the person making the request really controls the account they claim to use. That is the purpose of authentication.
Authentication is used at the start of a signed-in relationship. The person proves control of an accepted credential, such as a password or passkey. If the evidence is valid, the sign-in service produces a verified identity. The application can then create a session or accept a trusted identity result and use a stable account identifier on later requests.
The important point is that authentication answers only one question: who is this caller? It does not say what that caller may do. A customer may be correctly signed in and still be forbidden from reading another customer’s order or changing an administrative setting.
That is why authentication and authorization are separate. Authentication establishes identity. Authorization uses that identity, plus the requested action and resource, to decide whether access is allowed. Keeping those questions separate prevents a successful sign-in from becoming an accidental permission to do everything.
Investigation
Inspect the traffic, select a diagnosis in the checkpoint, then reveal the repair.
Check your understanding
Pass the lesson quiz
Answer every question correctly to unlock the next lesson. Retry as often as you need.