security - 身份验证与授权

Question

网络应用程序的上下文有什么区别？我经常看到缩写“auth”。它代表auth-entication 还是auth-orization？或者两者兼而有之？

Answer 1

Authentication is the process of ascertaining that somebody really is who they claim to be.

Authorization refers to rules that determine who is allowed to do what. E.g. Adam may be authorized to create and delete databases, while Usama is only authorised to read.

这两个概念是完全正交和独立的，但是两者都是安全设计的核心，如果其中任何一个概念不正确，就会导致妥协。

就网络应用程序而言，非常粗略地说，身份验证是指您检查登录凭据以查看是否识别出已登录的用户，而授权是指您在访问控制中查找是否允许用户查看，编辑、删除或创建内容。