Authorization
The process of determining what an authenticated user is allowed to do—controlling access to resources, features, and operations.
Detailed Explanation
Authorization follows authentication. Once the system knows who you are, authorization determines your permissions. Common models include Role-Based Access Control (RBAC), where users are assigned roles (admin, editor, viewer) that define permissions; Attribute-Based Access Control (ABAC), where permissions depend on user attributes, resource attributes, and environment conditions; and Access Control Lists (ACLs), where specific permissions are granted per resource.
Authorization is enforced at every layer: API endpoints check permissions before processing requests, UI elements are hidden or disabled based on roles, and database queries may filter results based on user permissions. Implementing authorization correctly is critical—a bug here can expose sensitive data or allow privilege escalation.
Why It Matters
Authorization prevents users from accessing data and features they should not have. It is critical for security, compliance, and user trust.
Real-World Example
In a project management tool, team members can view and edit tasks, project managers can manage team members, and admins can delete projects. Each role has different permissions enforced by authorization logic.
When to Use
Any application with multiple user roles or permission levels. Even simple apps need authorization to ensure users can only access their own data.
Advantages
- Enforces least-privilege access
- Prevents unauthorized data access
- Supports compliance requirements
- Enables multi-tenant applications
- Protects against privilege escalation
Disadvantages
- Complex to implement and test
- Role explosion in large systems
- Cross-cutting concern that touches every layer
- Hard to debug permission issues
- Performance overhead for fine-grained checks
Related Terms
Frequently Asked Questions
What is RBAC?
Role-Based Access Control assigns permissions to roles (admin, editor, viewer) rather than individual users. Users are assigned roles, and roles determine what they can access. RBAC simplifies permission management in most applications.
How do I implement authorization in my app?
Use middleware or decorators to check permissions at the API level. In the UI, conditionally render elements based on user roles. Store role/permission information in JWTs or fetch it from the database on each request.
What is the difference between authentication and authorization?
Authentication verifies identity (who you are). Authorization controls access (what you can do). You must authenticate first, then authorize based on the authenticated identity.
Can I use OAuth for authorization?
Yes. OAuth is fundamentally an authorization framework. It lets users grant third-party apps limited access to their resources. The scopes in OAuth tokens define what the app is authorized to do.
How do I handle authorization in microservices?
Use a centralized identity provider (OAuth/OIDC) and pass tokens with claims to each service. Each service validates the token and enforces its own authorization rules. Consider a policy engine like OPA for complex authorization logic.