Interview question

What is the difference between authentication and authorization, and how do you implement both securely? Authentication और authorization में क्या अंतर है और दोनों securely कैसे implement करें?

Answer

Concept	Question it answers	Example
Authentication	Who are you?	Login with email/password
Authorization	What are you allowed to do?	Only admins can delete users

// Authentication - verifying identity
if (password_verify($password, $user->password)) {
    session_regenerate_id(true);
    $_SESSION['user_id'] = $user->id;
}

// Authorization - checking permission
function requireRole($role) {
    if ($_SESSION['user_role'] !== $role) {
        http_response_code(403);
        die('Forbidden');
    }
}
requireRole('admin');

A common mistake is confusing the two - a user can be authenticated (logged in) but still not authorized for a specific action.

Concept	क्या पूछता है	उदाहरण
Authentication	आप कौन हैं?	Email/password से login
Authorization	आप क्या कर सकते हैं?	सिर्फ admin users delete कर सकते हैं

if (password_verify($password, $user->password)) {
    session_regenerate_id(true);
    $_SESSION['user_id'] = $user->id;
}

function requireRole($role) {
    if ($_SESSION['user_role'] !== $role) {
        http_response_code(403);
        die('Forbidden');
    }
}

Was this answer clear?

Subjects

Related questions