Full-stack Developer interview question
What is the difference between authentication and authorization?
Authentication proves who the caller is; authorization decides what that identity may do on a specific resource. Authenticate first, then enforce least-privilege authorization on the server for every protected operation.
Direct answer
What a strong answer covers
How it works
Authentication answers who is making the request, established once through a password, a federated login, a passkey, or a signed token, and carried on subsequent requests by a session cookie or bearer token. Authorisation answers whether that identity may perform this action on this resource, and must be evaluated on every request, close to the data, using roles, permissions, or ownership rules. Client-side checks only shape the UI; the server decides. Confusing the two produces systems where anyone logged in can read anyone else’s data.
Example
A user signs in with Google and receives a session; that is authentication. When they call GET /invoices/42, the server loads invoice 42 and checks that its owner_id matches the session user or that the user has the finance-admin role; that is authorisation, and it happens even though the UI never showed a link to another user’s invoice.
Common mistakes
- Treating a valid token as permission to access any resource ID passed in the URL.
- Hiding buttons in the frontend and calling that access control.
- Checking roles at the router level but not for nested or batch endpoints.
A useful answer structure
Answer from your own work.
Do not memorise a script: use only examples you can explain honestly in follow-up questions.
Open the desktop workspace and rehearse a clear answer in your own words.