authentication and authorization
Authentication establishes identity; authorization decides whether that identity may perform an operation.
Use this when Signed-in users can request records belonging to other users.
without the term
“Users have to log in, so the API is secure, right? Someone said any logged-in user could edit anyone's project by calling the API directly. Can you check and fix it?”
with the term · How do you ask a model for authentication and authorization?
Separate authentication from authorization on this endpoint. Test signed-out access, another user’s object, and the permitted owner’s request.
What is authentication and authorization?
Authentication answers 'who is this?' and authorization answers 'may they do this, to this record?'. Being signed in only settles the first question.
Why does authentication and authorization matter when vibe coding?
A page-level login check can leave direct API calls unprotected.
How do you do authentication and authorization?
Derive identity from trusted authentication and check the requested action at the authoritative boundary.
What goes wrong with authentication and authorization?
Trusting an owner or role field supplied in the request body.