Authorization Best Practices
Authorization controls what authenticated users are allowed to do. Proper authorization prevents privilege escalation and data leaks. Key principles: least privilege, server-side enforcement, and combining role-based access with resource ownership checks.
Authentication is showing your ID to get in. Authorization is the bouncer checking whether you have a VIP wristband for the VIP area. Even if you're in the club (authenticated), you shouldn't access areas you're not allowed (unauthorized).
1Principle of Least Privilege
Users and systems should have the minimum permissions necessary to perform their tasks. This limits damage if credentials are compromised.
2Role-Based Access Control (RBAC)
Map users to roles, and roles to permissions. Simple and effective for most applications.
const roles = {
admin: ['read', 'write', 'delete'],
editor: ['read', 'write'],
viewer: ['read']
};
function can(user, action) {
return roles[user.role]?.includes(action);
}3Resource Ownership Checks
For user-owned resources (posts, profiles, orders), always verify the requesting user owns the resource in addition to role checks.
| Property | Authentication | Authorization |
|---|---|---|
| Check | Session / JWT validation | Role + ownership verification |
| Example | Login with email/password | Can this user delete this post? |
| Purpose | Who are you? | What are you allowed to do? |
Authentication
Check
Session / JWT validation
Example
Login with email/password
Purpose
Who are you?
Authorization
Check
Role + ownership verification
Example
Can this user delete this post?
Purpose
What are you allowed to do?
Common questions
- ›“What is the difference between authentication and authorization?”
- ›“How do you implement authorization in a web app?”
- ›“Explain the principle of least privilege.”
- ›“How do you protect against unauthorized access to user resources?”
What interviewers look for
- Clear distinction between authn and authz
- Server-side enforcement mindset
- Understanding of RBAC and ownership checks
- Defense-in-depth thinking (middleware, validation)
Short answer (60 sec)
Authentication verifies identity. Authorization verifies permissions. Always enforce authorization server-side using role checks and resource ownership validation. Follow the principle of least privilege.
Detailed answer (senior level)
Authorization is separate from authentication. Use RBAC for role-based permissions and always check resource ownership for user-specific data. Implement checks in middleware or route handlers. Never trust client-side permission logic. Default to deny (fail securely) and log authorization failures.
- Assuming authentication is enough (authenticated ≠ authorized)
- Performing authorization checks only on the client side
- Missing ownership checks on user resources
- Using overly broad permissions (admin everywhere)
- Forgetting to protect all state-changing endpoints
- ✓Authentication = Who are you? Authorization = What can you do?
- ✓Always enforce authorization on the server
- ✓Follow principle of least privilege
- ✓Combine RBAC with resource ownership checks
- ✓Default to deny access
- ✓Protect ALL state-changing operations
- ✓Centralize authorization logic for maintainability
Related web fundamentals topics
Continue with closely related browser and frontend engineering concepts.