Authentication vs Authorization

The split

Authentication (authN) = "who are you?"        → can I log in?
Authorization  (authZ) = "what can you do?"    → what can this identity reach?

Order matters: authenticate FIRST, then authorize. Can’t authorize an unknown user.

Comparison

	Authentication	Authorization
Question	Who are you?	What can you do?
Credential	API key, password, JWT, OAuth token	Roles, scopes, ACLs, RBAC
Failure code	401 Unauthorized (bad/missing creds)	403 Forbidden (valid creds, no rights)
Happens	First	After auth
Example	valid `Authorization: Bearer eyJ...`	“this token can read /orders but not delete”

401 vs 403 (memorize)

401 = authentication failed   → "I don't know you"
403 = authorization failed    → "I know you, you still can't"

Authorization models

RBAC   = by role (admin / user / guest)
ABAC   = by attributes (department=finance AND time<18:00)
Scopes = by token grant (oauth: read:orders write:orders)

Bug classes map to this split

OWASP	Which is broken
API2 Broken Authentication	authN — weak login, guessable tokens, no login rate limit
API1 BOLA	authZ — valid user reads others’ objects (`id=123` → `id=124`)
API5 BFLA	authZ — valid user calls admin functions
API3 Property-Level	authZ at field level — read/write fields you shouldn’t

The CAPIJ core insight

Most APIs get authN right and authZ wrong. Login works fine — bugs live in what you can reach AFTER logging in. That’s why BOLA is OWASP #1: authenticated as yourself, then change an ID and read someone else’s data.

Auth mechanisms (CAPIE 1.3)

API Keys — static string, no expiry, no user context (weakest)
Basic Auth — base64(user:pass) per request (needs HTTPS)
Bearer tokens — token in Authorization header (no signature vs JWT)
JWT — signed, self-contained claims (header.payload.signature)
OAuth 2.0 — delegated authorization (access tokens, scopes)
OpenID Connect — identity layer on OAuth (ID tokens = who you are)
RBAC — role assignments enforced by the API

[[api-hacking/index]]
[[api-hacking/rest-vs-soap/index]]