Hacker News Reader

Comment by aliswe | Hacker News Reader

Really nice.

> But authorization does not require authentication, and neither does authentication require authorization.

Can you give an example on this?

* There are a handful of typos scattered through the text, about 5-10 errors

* As I was into learning mode, in the middle of the article I didn't initially notice that the server product you recommending was your own. I think a clarification there is in place

* Server-Side Distributed Applications, I don't have a solid conviction but I can't really see how multiple systems with multiple parallell accounts is a common, viable or even realistic situation...

View on HN

"Authorization" answers "does the entity have permission to access the requested resource?"

"Authentication" is "is the entity is who it says it is?"

"Entity logging in" is an example of authentication. Is the entity trying to log in the entity it claims to be? An example claimed identity is a username, and example proof of authentic claim is a correct password.

"Entity trying to read data" is an example of authorization. Does the entity trying to read the data have permission to read that data? Checking an access control list against a username is an example of checking authorization.

How are they different, and separate?

I claim to be a user and supply a password. My claim is authenticated and I successfully log in. I have requested access to zero resources and thus no authorization has occurred.

A hacker steals my session while I'm logged in and requests my sensitive data. The system sees the request came from a username that is on the access control list for the resource and authorizes the hacker to see my data. No check on my actual identity (authentication) occurred, only a check whether the provided identity is authorized.

Thanks for shedding more light on this.

> * There are a handful of typos scattered through the text, about 5-10 errors

Should be fixed now!

> Can you give an example on this?

An anonymous user is not authenticated but may still access some data.

> * Server-Side Distributed Applications, I don't have a solid conviction but I can't really see how multiple systems with multiple parallell accounts is a common, viable or even realistic situation...

This is actually not that unusual. Mostly happens when a company buys or uses a third-party CRM / SaaS or whatever!

> An anonymous user is not authenticated but may still access some data.

That was it, amazing... thanks for your help

Reply on news.ycombinator.com