Why authorization differs from authentication in Express - Visual Breakdown

Concept Flow - Why authorization differs from authentication

User sends credentials

↓

Authentication: Verify identity

Yes / No↓

Reject

↓

Authorization: Check permissions

↓

Access Denied

User first proves who they are (authentication). Then system checks what they can do (authorization).

Execution Sample

Express

app.post('/login', (req, res) => {
  const user = authenticate(req.body);
  if (!user) return res.status(401).send('Login failed');
  if (!authorize(user, 'admin')) return res.status(403).send('Access denied');
  res.send('Welcome admin');
});

This code checks user identity first, then checks if user has admin rights.

Execution Table

Step	Action	Input	Result	Next Step
1	Receive login request	{username, password}	Credentials received	Authenticate user
2	Authenticate user	{username, password}	User object or null	If user null, reject; else authorize
3	Check if user exists	User object or null	User found? Yes or No	If No, send 401; If Yes, check authorization
4	Authorize user	User object, role='admin'	Has admin rights? Yes or No	If No, send 403; If Yes, grant access
5	Send response	Authorization result	Access granted or denied message	End

💡 Execution stops after sending response based on authentication and authorization results.

Variable Tracker

Variable	Start	After Step 2	After Step 4	Final
user	null	User object or null	User object	User object or null

Key Moments - 2 Insights

Why do we check authentication before authorization?

Because authorization depends on knowing who the user is. The execution_table shows authentication happens first (Step 2), and only if successful do we check authorization (Step 4).

Can authorization happen without authentication?

No, because without confirming identity (authentication), the system cannot decide permissions. The flow in concept_flow and execution_table confirms authorization only happens after authentication success.

Visual Quiz - 3 Questions

Look at the execution_table, what happens if authentication fails at Step 3?

A Send 403 Access denied response

B Send 401 Login failed response

C Grant access immediately

D Proceed to authorization

💡 Hint

Check Step 3 and Step 2 results in execution_table for authentication failure.

At which step does the system check if the user has admin rights?

A Step 4

B Step 3

C Step 2

D Step 5

💡 Hint

Look at the 'Action' column in execution_table for authorization check.

If the user is authenticated but not authorized, what response is sent?

A Welcome admin

B Login failed

C Access denied

D No response

💡 Hint

See Step 4 and Step 5 in execution_table for authorization denial.

Concept Snapshot

Authentication means checking who you are.
Authorization means checking what you can do.
Authentication happens first, then authorization.
Failing authentication stops access immediately.
Authorization depends on successful authentication.

Full Transcript

This visual execution shows how authentication and authorization differ in an Express app. First, the user sends credentials. The system authenticates by verifying identity. If authentication fails, it sends a 401 error and stops. If successful, it checks authorization to see if the user has permission, like admin rights. If authorization fails, it sends a 403 error. If both pass, access is granted. The 'user' variable changes as the code runs. This step-by-step flow helps understand why authentication must come before authorization.

Practice

1. In Express apps, what is the main difference between authentication and authorization?

easy

A. Authentication checks what the user can access; authorization verifies who they are.

B. Authentication verifies who the user is; authorization checks what they can access.

C. Authentication and authorization both check user identity only.

D. Authorization is done before authentication in Express.

Solution

1. Step 1: Understand authentication purpose

   Authentication confirms the user's identity, like logging in.

2. Step 2: Understand authorization purpose

   Authorization decides what resources or actions the authenticated user can access.

3. Final Answer:

   Authentication verifies who the user is; authorization checks what they can access. -> Option B

4. Quick Check:

   Authentication = identity, Authorization = permissions [OK]

Hint: Authentication = who, Authorization = what they can do [OK]

Common Mistakes:

• Confusing authentication with authorization
• Thinking both check the same thing
• Assuming authorization happens before authentication

2. Which Express middleware is typically used for authentication?

easy

A. passport.authenticate()

B. cors()

C. express.json()

D. express.static()

Solution

1. Step 1: Identify authentication middleware

   Passport.js is a popular Express middleware for handling authentication.

2. Step 2: Check other options

   express.static serves files, express.json parses JSON, cors handles cross-origin requests, none handle authentication.

3. Final Answer:

   passport.authenticate() -> Option A

4. Quick Check:

   passport.authenticate() = authentication middleware [OK]

Hint: Passport is for authentication in Express [OK]

Common Mistakes:

• Choosing express.static for authentication
• Confusing cors with authentication
• Not knowing passport middleware

3. Consider this Express route snippet:

app.get('/dashboard', (req, res) => {
  if (!req.user) {
    return res.status(401).send('Not authenticated');
  }
  if (!req.user.isAdmin) {
    return res.status(403).send('Not authorized');
  }
  res.send('Welcome Admin');
});

What status code will be sent if a logged-in user is not an admin?

medium

A. 200

B. 401

C. 403

D. 500

Solution

1. Step 1: Check authentication condition

   The code checks if req.user exists; if not, sends 401 (unauthenticated).

2. Step 2: Check authorization condition

   If user exists but isAdmin is false, sends 403 (forbidden, unauthorized).

3. Final Answer:

   403 -> Option C

4. Quick Check:

   Authenticated but not authorized = 403 [OK]

Hint: 401 = no login, 403 = no permission [OK]

Common Mistakes:

• Mixing 401 and 403 status codes
• Assuming 200 is sent without admin rights
• Ignoring the authorization check

4. This Express middleware aims to protect routes:

function checkAdmin(req, res, next) {
  if (!req.user.isAdmin) {
    res.status(401).send('Unauthorized');
  }
  next();
}

What is the bug here?

medium

A. req.user might be undefined causing an error

B. Should send status 403 instead of 401 for authorization failure

C. Missing call to next() inside the if block

D. Middleware should be async

Solution

1. Step 1: Analyze req.user usage

   The code accesses req.user.isAdmin without checking if req.user exists, risking a runtime error.

2. Step 2: Check other issues

   While 403 is better for authorization failure, the main bug is possible crash from undefined req.user.

3. Final Answer:

   req.user might be undefined causing an error -> Option A

4. Quick Check:

   Always check req.user exists before properties [OK]

Hint: Check req.user exists before isAdmin [OK]

Common Mistakes:

• Ignoring possible undefined req.user
• Confusing 401 and 403 status codes
• Not returning after sending response

5. You want to protect an Express route so only authenticated users with role 'editor' or 'admin' can access it. Which middleware logic correctly implements this authorization check?

hard

A. if (req.user && req.user.role === 'admin') { next(); } else { res.status(403).send('Forbidden'); }

B. if (!req.user && (req.user.role === 'editor' || req.user.role === 'admin')) { next(); } else { res.status(401).send('Unauthorized'); }

C. if (req.user.role === 'editor' || req.user.role === 'admin') { next(); } else { res.status(401).send('Unauthorized'); }

D. if (!req.user || (req.user.role !== 'editor' && req.user.role !== 'admin')) { res.status(403).send('Forbidden'); } else { next(); }

Solution

1. Step 1: Check authentication and authorization together

   The middleware must first confirm req.user exists (authenticated), then check if role is 'editor' or 'admin'.

2. Step 2: Analyze each option

   if (!req.user || (req.user.role !== 'editor' && req.user.role !== 'admin')) { res.status(403).send('Forbidden'); } else { next(); } correctly denies access if no user or role not allowed, sending 403 Forbidden. Others have logic errors or wrong status codes.

3. Final Answer:

   if (!req.user || (req.user.role !== 'editor' && req.user.role !== 'admin')) { res.status(403).send('Forbidden'); } else { next(); } -> Option D

4. Quick Check:

   Check user exists AND role allowed for authorization [OK]

Hint: Check user exists AND role matches before next() [OK]

Common Mistakes:

• Not checking if user is authenticated first
• Using wrong status codes (401 vs 403)
• Incorrect logical operators in role check