Can you explain the difference between authentication and authorization in Spring Security?

Question

Accepted Answer

Authentication and Authorization are two fundamental security concepts in Spring Security. Authentication verifies the identity of a user, while Authorization determines what actions or resources that authenticated user is allowed to access.

Key Points:
• Authentication answers the question: "Who are you?"
• Authorization answers the question: "What are you allowed to do?"
• Authentication always happens before authorization.

Example:
Consider an internet banking application:

Step 1:
The user enters a username and password.

Spring Security verifies the credentials and confirms the user's identity.

This process is Authentication.

Step 2:
After successful login, Spring checks whether the user has permission to perform actions such as:

• View Account Details
• Transfer Money
• Approve Transactions
• Access Admin Dashboard

This process is Authorization.

Comparison:

Authentication:
• Verifies user identity.
• Uses credentials such as username/password, JWT token, or OAuth token.
• Result: User is authenticated.

Authorization:
• Verifies user permissions and roles.
• Uses roles and privileges such as ROLE_USER or ROLE_ADMIN.
• Result: Access is granted or denied.

Code Example:

Authentication Example:

```
http
    .formLogin();
```
This enables user authentication.

Authorization Example:

http
    .authorizeHttpRequests(auth -> auth
        .requestMatchers("/admin/**")
        .hasRole("ADMIN")
        .requestMatchers("/user/**")
        .hasRole("USER")
        .anyRequest()
        .authenticated()
    );

Here:

• Users with ROLE_ADMIN can access /admin/** endpoints.
• Users with ROLE_USER can access /user/** endpoints.

Real-World Example:

Airport Security:

Authentication:
• Showing your passport at the airport entrance proves your identity.

Authorization:
• Your boarding pass determines which flight and gate you can access.

Spring Security Flow:

User Request
      ↓
Authentication
      ↓
Identity Verified?
      ↓
Authorization
      ↓
Permission Check
      ↓
Access Granted or Denied

Common Authentication Methods:

• Username and Password
• JWT Authentication
• OAuth2
• LDAP Authentication
• Social Login

Common Authorization Methods:

• Role-Based Access Control (RBAC)
• Permission-Based Access Control
• Method-Level Security

Interview Tip:
A concise interview answer is: Authentication is the process of verifying the identity of a user using credentials such as username and password or tokens. Authorization is the process of determining what resources or operations that authenticated user is permitted to access. In Spring Security, authentication occurs first, followed by authorization based on roles and permissions.