Authentication versus authorization

What this lesson covers

• Separate identity from permission checks
• Enforce authorization on the server, every time
• Catch insecure direct object references

This lesson sits in Thinking About Threats, part of Practical Web Security. It assumes what came before it and leads directly into the next lesson in the module.