2 docs tagged with "authorization"

This chapter explains the difference between authentication and authorization from the angles of ordering, status codes for failure, and where implementation lives. It covers the three authentication factors, how to carry authentication state via sessions vs. tokens, authorization models like RBAC, and how to structure a written answer.

This chapter covers, for junior engineers and from a database-design angle, the difference between authentication and authorization, password hashing (bcrypt/argon2), session management, multi-factor authentication (MFA / TOTP), account lockout (OWASP/NIST compliant), and audit logs.