security Junior

What is the difference between authorization and authentication?

Short Answer

Authentication verifies WHO you are (login). Authorization determines WHAT you can do (permissions).

Detailed Answer

Authentication: - Verifies identity: Are you who you say you are? - Happens at login (username/password, token, OAuth) - Managed by guards and providers - Uses auth()->attempt(), auth()->check() - Returns: authenticated user or guest Authorization: - Determines access: Can this user perform this action? - Happens after authentication - Managed by Gates and Policies - Uses $this->authorize(), @can, can() - Returns: allowed or denied (403) In Laravel: - Authentication: auth middleware, Breeze, Sanctum - Authorization: Gates, Policies, Spatie Permission

Code Example

Example

// Authentication - verifying identity
if (auth()->attempt($credentials)) {
    // User is authenticated
}

Route::middleware('auth')->group(function () {
    // Only authenticated users
});

// Authorization - checking permissions
public function update(Post $post)
{
    $this->authorize('update', $post); // Throws 403 if denied
    // User is authorized
}

// Gate definition
Gate::define('edit-settings', function (User $user) {
    return $user->isSuperAdmin();
});

// Blade authorization
@can('update', $post)
    <button>Edit</button>
@endcan

// Check in code
if ($user->can('delete', $post)) {
    // User can delete
}

Interview Tip

This is a very common interview question. Keep it simple: "Authentication is login, authorization is permissions. Laravel handles both differently."