←  All terms
A
Security & Compliance

Authorization

Authorization determines which data and functions an authenticated identity is allowed to access.

Authorization determines which data and functions an authenticated identity is allowed to access. The appropriate design depends on the data, risk, and jurisdiction and requires both technical and organizational review. The concept is closely related to Authentication and Role-Based Access Control.

Read more

Authentication

Role-Based Access Control

OAuth

Web Application

FAQ

Authorization

Is OAuth a method for authorization or for authentication?
OAuth 2.0 is a protocol for delegated authorization: an application gets limited access to data without ever knowing the password. OpenID Connect is layered on top for verifying identity. The two are often used together but solve different problems. This distinction prevents flawed login designs.
What are typical authorization mistakes?
Typical mistakes are checks performed only in the frontend, overly broad roles, and permissions left behind after role changes. A hidden button protects nothing if the backend still accepts the request. Every permission must be verified server-side on each access.
How does authorization work with roles and permissions?
In role-based authorization, users receive roles such as editor or administrator, and each role bundles permissions. This simplifies administration compared with individual grants. The principle of least privilege has proven its worth: each role gets only the permissions its tasks require.