What is the difference between authentication and authorization in Spring Security? स्प्रिंग सिक्योरिटी में ऑथेंटिकेशन और ऑथराइज़ेशन में क्या अंतर है?

Authentication answers "who are you?" — verifying a user's identity through credentials such as a username/password, JWT token, or OAuth2 token, resulting in a populated Authentication object stored in the SecurityContext. Authorization answers "what are you allowed to do?" — deciding whether the authenticated user has permission to access a resource or perform an action, based on roles or authorities.

In Spring Security, authentication happens first (via an AuthenticationManager and AuthenticationProvider), and authorization happens afterward, evaluated through URL-based rules in the filter chain or method-level annotations like @PreAuthorize.

http.authorizeHttpRequests(auth -> auth
    .requestMatchers("/admin/**").hasRole("ADMIN")
    .requestMatchers("/user/**").hasAnyRole("USER", "ADMIN")
    .anyRequest().authenticated());