beginnerFoundations: What Is Security, and Why Should You Care?

What is the difference between Authentication and Authorization?

Authentication verifies WHO a user is (identity check — e.g., validating username/password or a token's signature). Authorization decides WHAT an authenticated user is allowed to do (permission check — e.g., roles, authorities, ACLs). Authentication always happens first; authorization only makes sense once identity is established. HTTP-wise, a failed authentication returns 401 Unauthorized, while a failed authorization returns 403 Forbidden.

Ready to master this question?

Generate a complete walkthrough — background, the full answer in plain language, a working code example explained line by line, a real-world scenario, common mistakes, and how this same question gets asked in different ways.

Next Step

Continue to What is a Servlet Filter, and how is it different from a Servlet? →← Back to all Spring Security questions