Kuna tofauti gani kati ya uthibitisho (authentication) na idhini (authorization)?

Question

Accepted Answer

**Uthibitisho** unathibitisha **wewe ni nani** (utambulisho), wakati **idhini** inahakikisha **kile ulichoruhusiwa kufanya** (ruhusa). Ni tofauti lakini zinaunganisha — uthibitisho huanza kwanza (thibitisha utambulisho), kisha idhini (angalia ruhusa). Kuwachafua ni kosa linalojirudia.

## Uthibitisho — wewe ni nani?

```text
AUTHENTICATION (AuthN) verifies IDENTITY — confirming you are who you claim to be:
  → login with credentials (password), tokens, biometrics, multi-factor (MFA)
  → "Prove you are Ann" → the system confirms your identity
→ answers: WHO are you?
```

## Idhini — kile ulichoruhusiwa kufanya?

```text
AUTHORIZATION (AuthZ) determines PERMISSIONS — what an authenticated user is allowed to do:
  → can this user access this resource? perform this action? (roles, permissions)
  → "Ann is authenticated, but is she allowed to delete this record?"
→ answers: what are you ALLOWED to do?
```

## Uhusiano na mpangilio

```text
1. AUTHENTICATION first → establish WHO you are (log in)
2. AUTHORIZATION next → check what you're ALLOWED to do (per request/action)
→ You must be authenticated before authorization is meaningful (know who, then what they can do).
→ Both are needed: authenticated but unauthorized (logged in, but can't do X) is common.
```

## Makosa yanayojirudia

```text
⚠️ Confusing the two (they're different concerns)
⚠️ BROKEN ACCESS CONTROL (authorization flaws) → a TOP vulnerability (OWASP #1):
   → not checking authorization properly → users access/modify what they shouldn't
   → e.g. changing an ID in a URL to access another user's data (IDOR)
→ Always enforce authorization on the SERVER for every protected action.
```

## Kwa nini ni muhimu

Kuelewa tofauti kati ya uthibitisho na idhini ni muhimu kwa msingi kwa sababu ni **dhana za usalama za msingi za udhibiti wa upatikanaji**, na kuwachafua ni kosa linalojirudia na linaloathiri, kwa hivyo ni maarifa muhimu ya usalama.

Tofauti — **uthibitisho unathibitisha wewe ni nani** (utambulisho, kupitia kuingia/ujumbe wa siri/MFA) wakati **idhini inahakikisha kile ulichoruhusiwa kufanya** (ruhusa, kuangalia upatikanaji wa rasilimali na vitendo) — ni muhimu kwa jinsi programu zinadhibiti upatikanaji, na kuelewa ni wazi ni muhimu kwa kujenga mifumo salama.

Kuelewa **uhusiano na mpangilio** (uthibitisho kwanza kuanzisha utambulisho, kisha idhini kuangalia ruhusa kwa kila hatua, na zote mbili ni mahitaji — mtumiaji amethibitishwa lakini anaweza kuwa hajaidhinishwa kwa vitendo maalum) hubaini jinsi zinavyofanya kazi pamoja katika udhibiti wa upatikanaji.

Kwa muhimu, kuelewa **makosa yanayojirudia** ni muhimu: kuwachafua dhana hizi mbili, na hasa **udhibiti wa upatikanaji uliovunjika** (hitilafu za idhini — hatari ya #1 ya OWASP) ambapo idhini haijahakikishwi vizuri, na kumruhusu mtumiaji kupatia au kurekebisha kile asichokuweza (kama njia ya IDOR ya kubadilisha kitambulisho katika URL kufikirija data ya mtumiaji mwingine).

Mwongozo wa **kuanzisha idhini kila wakati kwenye seva kwa kila hatua iliyolindwa** ni mbinu muhimu ya usalama — udhalifu wa kawaida ni kushindwa kuangalia idhini vizuri, au kutegemea mteja kuanzisha idhini.

Kwa sababu udhibiti wa upatikanaji (uthibitisho + idhini) ni muhimu kwa usalama wa programu na kuwachafua au kuhandha dhana hizi vibaya kunasababisha udhalifu mkali (hasa udhibiti wa upatikanaji uliovunjika, hatari ya juu), na kwa sababu kuelewa tofauti, mpangilio wao, na makosa ya kawaida ya idhini ni muhimu kwa kujenga mifumo salama, kuelewa uthibitisho dhidi ya idhini ni maarifa muhimu ya usalama — dhana za msingi za udhibiti wa upatikanaji ambazo kila mtengenezaji lazima aelewa vizuri, muhimu kwa kujenga programu salama na kuepuka udhalifu wa udhibiti wa upatikanaji uliovunjika ambao ni kati ya hitilafu zinazojifanya mara kwa mara na muhimu zaidi.