What is the difference between authentication and authorization?
Assesses fundamental understanding of Authentication & Authorization conventions, runtime behavior, and memory/performance considerations.
Hiring managers look for precision, avoidance of ambiguous jargon, and ability to explain trade-offs under real production conditions.
Authentication (authn) establishes who the caller is: verifying a password, a session cookie, a token or a certificate. Authorization (authz) decides what that identified caller is allowed to do.
authn: "You are user 42." -> 401 if missing
authz: "User 42 may delete this order." -> 403 if denied
Authentication normally happens once per session or token, while authorization is evaluated per request or per resource. A common bug is stopping at authentication and forgetting authorization, allowing any logged-in user to access another user's data (an insecure direct object reference). Best practice is to enforce authorization close to the data, for example scoping every query by the caller's tenant or user id, rather than trusting an id supplied by the client. Keep identity data in the token or session and derive permissions from a central policy or role service.
Candidate Response Strategy & Interview Tips
- Start with a concise one-sentence summary: Deliver a direct, confident answer first before expanding into nuances.
- Demonstrate real-world trade-offs: Discuss where this approach excels and when you would avoid it in production systems.
- Discuss complexity & edge cases: Proactively explain time/space complexity or boundary conditions (null values, scale limits).
- Prepare for interviewer follow-ups: Technical hiring panels frequently probe deeper into concurrency, backward compatibility, or alternative libraries.