4 ms·
> the distinction between authentication and authorization Distinction which is totally useless in practice as you certainly won’t have authorization without a
by tasogare 6y ago
> the distinction between authentication and authorization
Distinction which is totally useless in practice as you certainly won’t have authorization without authentication.
- sjroot 6y agoSomewhat. One key “feature” of OAuth is that it completely omits the authentication process.
- caseysoftware 6y agoThe distinction is irrelevant if you just consider that authorization (authZ) always happens after authentication (authN) but it is important when you realize that different components/systems/protocols might be used in each. At that point, the separation is more about capabilities/responsibilities than "does it happen?" (This is what I do in my day job.)