Authentication vs Authorization: Labada Eray ee Developer Kasta Ay Tahay Inuu Kala Fahmo

Marka user-ku login sameeyo, badanaa waxaan nidhaahnaa "user-ka waa la authenticate-gareeyay." Laakiin taas macnaheedu ma aha inuu user-ku wax kasta samayn karo.

Halkaas ayay ku kala duwan yihiin Authentication iyo Authorization.

🔐 Authentication — "Who are you?"

Authentication waxay xaqiijisaa aqoonsiga user-ka.

Tusaale ahaan:

• Email + Password
• OTP
• Google Login
• Passkeys
• Access Token

Marka user-ku si sax ah u login-gareeyo, system-ku wuxuu ogaanayaa:

"User-kan waa Ahmed."

🛡️ Authorization — "What are you allowed to do?"

Authorization waxay go'aamisaa waxyaabaha user-ka loo oggol yahay inuu sameeyo.

Tusaale:

Ahmed → Member

Wuxuu:

• Akhrin karaa posts
• Abuuri karaa post
• Edit-gareyn karaa post-kiisa

Laakiin ma awoodi karo inuu:

Delete another user's post
Ban a user
Manage community settings

Haddii user-ku yahay:

Admin

markaas permissions badan ayaa loo oggolaan karaa.

Tusaale fudud

Login
   ↓
Authentication
   ↓
"Who are you?"
   ↓
Ahmed
   ↓
Authorization
   ↓
"What can Ahmed do?"
   ↓
Member permissions

Khaladka halista ah

Developer-ku wuxuu mararka qaar frontend-ka ku qariyaa button:

Delete User

oo u maleeyaa in tani security tahay.

Laakiin qofku wuxuu si toos ah API-ga ugu diri karaa request:

DELETE /users/123

Sidaa darteed authorization waa in backend-ka lagu hubiyaa, ma aha frontend-ka oo keliya.

Frontend-ku wuxuu hagaajiyaa UX.

Backend-ku wuxuu ilaaliyaa security.

Gunaanad

Authentication waxay ka jawaabtaa:

"Yaa tahay?"

Authorization waxay ka jawaabtaa:

"Maxaad samayn kartaa?"

Labadan concept waa aasaaska security-ga applications-ka casriga ah.

💬 Dood: Mashruuca aad hadda dhisayso sidee ayaad u maamushaa roles iyo permissions — RBAC, permissions gaar ah, mise hab kale?