Skip to content
Security Lab

Authentication & Authorization

AvailableIdentity and accessBeginner

Who are you, and what are you allowed to do? Follow fictional requests through login, sessions and permission checks.

Sign in to a fictional app, let sessions expire and switch between Admin, Editor and Viewer. Every simulated request shows the response it gets, 200, 401 or 403, and which check produced it.

Authentication: who is asking?
The server looks at the session that comes with the request. With no session, or an expired one, it can't tell who is asking, so it answers 401 Unauthorized.
Authorization: is this allowed?
Once it knows who is asking, the server checks that person's role for this exact action. A valid identity without the right permission gets 403 Forbidden.
Authentication comes first
There is nothing to authorize until the server knows who is asking. That is why an expired session gives 401, never 403.
Only the server decides
Hiding a button is a convenience, not security. Anyone can send a request without the interface, so every check has to run on the server.

What you will learn

  • Tell authentication apart from authorization, and know which one failed from the response.
  • Understand what a session is, why it expires and what happens to a request afterwards.
  • Read a role and permission matrix and predict who can do what.
  • Know when an API should answer 200, 401 or 403.

Guided challenge

  • AvailableBeginner

    Access Denied

    Decide which roles may perform each action, then defend your permission matrix against tricky requests.

See all guided challenges
Back to the catalog