Menene bambanci tsakanin authentication da authorization?

Question

Accepted Answer

**Authentication** yana tabbatar da **waɗa kike** (asali), yayin da **authorization** yana ƙayyade **abin da ka iya buɗata** (ikon). Suna daban-daban amma suna da alaƙa — authentication ya zo da farko (tabbatar da asali), sannan authorization (bincika ikon). Haɗa su ba a buɗe ba ne kuskure ne da ya gabace.

## Authentication — waɗa kike?

```text
AUTHENTICATION (AuthN) verifies IDENTITY — confirming you are who you claim to be:
  → login with credentials (password), tokens, biometrics, multi-factor (MFA)
  → "Prove you are Ann" → the system confirms your identity
→ answers: WHO are you?
```

## Authorization — menene za ka iya buɗata?

```text
AUTHORIZATION (AuthZ) determines PERMISSIONS — what an authenticated user is allowed to do:
  → can this user access this resource? perform this action? (roles, permissions)
  → "Ann is authenticated, but is she allowed to delete this record?"
→ answers: what are you ALLOWED to do?
```

## Alaƙar da tsariba

```text
1. AUTHENTICATION first → establish WHO you are (log in)
2. AUTHORIZATION next → check what you're ALLOWED to do (per request/action)
→ You must be authenticated before authorization is meaningful (know who, then what they can do).
→ Both are needed: authenticated but unauthorized (logged in, but can't do X) is common.
```

## Kuskuren gida

```text
⚠️ Confusing the two (they're different concerns)
⚠️ BROKEN ACCESS CONTROL (authorization flaws) → a TOP vulnerability (OWASP #1):
   → not checking authorization properly → users access/modify what they shouldn't
   → e.g. changing an ID in a URL to access another user's data (IDOR)
→ Always enforce authorization on the SERVER for every protected action.
```

## Menene mahaɗi

Ganewa bambancin tsakanin authentication da authorization ya zama aiki mai mahimmanci saboda suna **manufofi mahimmancin jiya da ke tsakani ga sharuddar shiga**, kuma haɗa su ba a buɗe ba ne kuskure ne da ya gabace, saboda haka sani na jiya ya zama aiki mai mahimmanci.

Bambancin — **authentication yana tabbatar da waɗa kike** (asali, ta hanyar shigo/ƙura/MFA) yayin da **authorization yana ƙayyade menene ka iya buɗata** (ikon, bincika shiga da aiki akan albashu) — ya zama aiki mai mahimmanci don yadda aikace-aikace suke sarrafa shiga, kuma ganewa kyakkyawa ya zama aiki da mahimmanci don gini tsarin jiya.

Ganewa **alaƙar da tsariba** (authentication da farko don tabbatar da asali, sannan authorization don bincika ikon kai-kai ga aiki, tare da buɗe — mai asali za a iya zama wanda ba sa ikon don aiki na musamman) yana haɗa yadda suka taimaka tare a sarrafa shiga.

Maƙarƙashe, ganewa **kuskuren gida** ya zama mahimmanci: haɗa manufofi biyu, kuma musamman **karancin sarrafa shiga** (kuskuren authorization — OWASP's #1 hadari) inda authorization ba a bincika sosai ba, yana ba wa masu amfani damar shiga ko buba abin da ba su kamata (kamar hadari na IDOR na canja ID a cikin URL don shiga bayanan mai amfani na waje).

Abubuwan kada a biya ga **koda koda jiya ga server ga kowa abubuwan karancin** ya zama aiki na jiya — kuskurin tunani na gaske shine kura shiga ikon, ko dogara ga client don tilasta.

Ko da shiga (authentication + authorization) ya zama aiki mahimmanci ga jiya aikace-aikace kuma haɗa ko ɗauki-ɗauki manufofi kaɗai yana geɗa hadari masu ɗorewa (musamman karancin sarrafa shiga, hadarin sama), kuma saboda ganewa bambancin, tsariba, da kuskuren authorization mahimmanci ne don gini tsarin jiya, ganewa authentication da authorization ya zama aiki na mahimmanci, manufofi aiki da kowa na yakamata ganewa kyakkyawa, mahimmanci ga gini tsarin jiya kuma riyaya karancin-access-control hadari waɗanda sune cikin hadari mafi yawa da mabugu.