身份验证(authentication)和授权(authorization)有什么区别?

Question

Accepted Answer

**身份验证(Authentication)** 验证**你是谁**(身份),而**授权(Authorization)** 决定**你可以做什么**(权限)。它们是不同的但相关的概念——身份验证在先(证明身份),然后授权(检查权限)。混淆这两者是常见错误。

## 身份验证 — 你是谁?

```text
AUTHENTICATION (AuthN) verifies IDENTITY — confirming you are who you claim to be:
  → login with credentials (password), tokens, biometrics, multi-factor (MFA)
  → "Prove you are Ann" → the system confirms your identity
→ answers: WHO are you?
```

## 授权 — 你可以做什么?

```text
AUTHORIZATION (AuthZ) determines PERMISSIONS — what an authenticated user is allowed to do:
  → can this user access this resource? perform this action? (roles, permissions)
  → "Ann is authenticated, but is she allowed to delete this record?"
→ answers: what are you ALLOWED to do?
```

## 两者的关系和顺序

```text
1. AUTHENTICATION first → establish WHO you are (log in)
2. AUTHORIZATION next → check what you're ALLOWED to do (per request/action)
→ You must be authenticated before authorization is meaningful (know who, then what they can do).
→ Both are needed: authenticated but unauthorized (logged in, but can't do X) is common.
```

## 常见错误

```text
⚠️ Confusing the two (they're different concerns)
⚠️ BROKEN ACCESS CONTROL (authorization flaws) → a TOP vulnerability (OWASP #1):
   → not checking authorization properly → users access/modify what they shouldn't
   → e.g. changing an ID in a URL to access another user's data (IDOR)
→ Always enforce authorization on the SERVER for every protected action.
```

## 为什么这很重要

理解身份验证和授权之间的区别至关重要,因为它们是**访问控制的核心安全概念**,混淆两者是常见且后果严重的错误,因此这是必要的安全知识。

这种区分——**身份验证验证你是谁**(身份,通过登录/凭证/多因素认证)而**授权决定你可以做什么**(权限,检查对资源和操作的访问权限)——是应用程序如何控制访问的基础,清楚地理解它对于构建安全系统至关重要。

理解**两者的关系和顺序**(先进行身份验证以确立身份,然后为每个操作检查授权,两者都需要——已认证的用户仍可能被拒绝特定操作)明确了它们如何在访问控制中协同工作。

至关重要的是,理解**常见错误**很重要:混淆这两个概念,尤其是**访问控制缺陷**(授权漏洞——OWASP的#1风险),其中授权检查不充分,导致用户可以访问或修改他们不应该修改的内容(如IDOR漏洞,通过更改URL中的ID来访问其他用户的数据)。

**始终在服务器上为每个受保护的操作强制执行授权**的指导是基本的安全实践——一个常见的真实漏洞是未能正确检查授权,或依赖客户端来强制执行授权。

由于访问控制(身份验证+授权)对应用程序安全至关重要,混淆或误处理这些概念会导致严重漏洞(尤其是访问控制缺陷,排名最高的风险),并且由于理解这种区分、它们的顺序以及常见授权错误对于构建安全系统至关重要,理解身份验证与授权是必要的、基础的安全知识——是访问控制的核心概念,每个开发人员都必须清楚地理解,这对于构建安全应用程序和避免访问控制缺陷漏洞(这些是最常见和最严重的安全缺陷之一)至关重要。