Authentication vs authorisation

Authentication asks who you are. Authorisation asks what you may do. Mixing them up causes real breaches.

The idea

Login (authentication) proves identity once and gives the browser a session cookie or token. Every later request is then checked against what that identity is allowed to do (authorisation). 401 means "we don’t know who you are"; 403 means "we know, and the answer is no".

Code

app.MapPost("/login", (Login l, Users u, HttpContext ctx) =>
{
    var user = u.Verify(l.Email, l.Password);   // hash compare
    if (user is null) return Results.Unauthorized();
    ctx.SignInAsync(user.ToPrincipal());        // session cookie
    return Results.Ok();
});
app.MapDelete("/admin/users/{id}", DeleteUser)
   .RequireAuthorization(p => p.RequireRole("Admin"));
// signed in but not Admin -> 403 Forbidden

Tips

• Store passwords only as slow salted hashes (bcrypt, Argon2), never encrypted or plain.
• Check authorisation on the server for every request. Hiding a button in the UI is not access control.
• RBAC grants by role; ABAC grants by attributes such as owner or department.

In the .NET library

ASP.NET Core separates UseAuthentication (who) from UseAuthorization (what), and policies with RequireRole or custom requirements express the rules.