What is the difference between authentication and authorization? Give an example from a web app.
What the interviewer wants to hear
- Authentication proves who the user is
- Authorization decides what that user is allowed to do
- Authentication happens first, then authorization on each request
- Authorization must be checked on the server, not only hidden in the UI
- 401 vs 403 status codes
Model answer
Authentication answers who are you. For example, a user logs in with email and password or Google sign-in, and the server creates a session. Authorization answers what are you allowed to do. For example, in a school app, a logged-in student can view their own marks, but only a teacher can edit marks, and only an admin can add teachers. Authentication happens first and authorization is checked on every request that touches data. An important point is that authorization must be enforced on the server, inside the API or server action, not just by hiding a button in the UI, because anyone can call the API directly. If the user is not logged in I return 401, and if they are logged in but not allowed I return 403. I also check ownership, so user A cannot read user B data by changing an id in the URL.
Can you answer it under time pressure?
Take a timed easy round and get scored on every answer.
More easy Full Stack Developer questions
- What happens, step by step, when a user types your app URL into the browser and presses Enter?
- Design the REST API endpoints for a simple blog with posts and comments. What URLs, methods and status codes would you use?
- You are starting a new e-commerce app. Would you choose a SQL or a NoSQL database, and why?
- Explain client-side rendering, server-side rendering and static site generation. When would you use each?
- In a web app with a React frontend and an API, where should input validation happen, and why?
- A page loads data from your API. How do you handle loading, empty and error states so users are never left confused?
- How do you manage configuration and secrets across development, staging and production for a full-stack app?
- How would you explain a database index to a junior developer, and how do you decide which columns to index?
- Describe the Git and code review workflow you follow when building a feature on a team.