What is authentication vs authorization?

Authentication (Are you the real user?)

Authentication refers to the process of checking the identity of the user.
It answers the question:

– “Who are you?”

Examples:

• Email and password login.
• Identified through a fingerprint or face ID.
• Glogging in through Google or Facebook.
• The verification of the token of the user by Firebase Auth.

In your projects (like Laravel + Firebase or Vue.js), authentication ensures the right person is logging in.

Authorization (What are you allowed to do?)
Authorization defines what one cannot or can do as a user once an individual has been authenticated.

It answers the question:
–  “What can you do?”

Examples:

• A normal user cannot access the dashboard but the grant can.
• One is able to see his/her profile, but not others.
• Role-based access control (RBAC).
• Gate or Policy permissions of Laravel.

You enter a company building:

1. Authentication – Security checks your ID card to confirm it’s really you.
2. Authorization – They check what floors or rooms your ID allows you to access.

 In Web Development (especially your projects)

• Firebase Auth = Authentication
• Laravel Breeze / Sanctum / JWT = Authentication
• Laravel Gates / Policies / Middleware = Authorization
• Vue.js Route Guards = Authorization