LetMeCheck.ai
    Start free
    Authentication vs authorization
    Authentication

    What's the difference between authentication and authorization?

    SHORT ANSWER

    Authentication checks who someone is, usually with a login. Authorization checks what that person is allowed to do once they are in. An app needs both: knowing a user is logged in does not mean they should see another user's data.

    Also called: AuthN vs AuthZ

    ON THIS PAGE
    What it meansWhy it matters for vibe-coded appsExampleHow to check if your app has this problemHow to fix it

    What it means

    Think of a hotel. Authentication is the front desk checking your ID and giving you a key card. Authorization is the card only opening your room, not every room.

    Most AI-built apps get authentication working first, because you can see it: a login screen. Authorization is invisible, and it is easy to leave out without noticing.

    Why it matters for vibe-coded apps

    Everything works in testing because you only ever log in as yourself, so the missing check never shows up.

    IF THIS IS WRONG IN YOUR APP
    • A logged-in user can change a number in the web address and see someone else's order, profile or invoice.
    • Ordinary users may be able to call admin-only actions.
    • The app looks secure because it has a login page, which makes the gap harder to spot.

    Example

    A route that returns an order by its ID.

    ✕ RISKYChecks you are logged in, but not whose order it is
    app.get("/orders/:id", requireLogin, async (req, res) => {
  const order = await db.orders.find(req.params.id);
  res.json(order);
});
    ✓ SAFERAlso checks the order belongs to you
    app.get("/orders/:id", requireLogin, async (req, res) => {
  const order = await db.orders.find(req.params.id);
  if (!order || order.user_id !== req.user.id) return res.status(404).end();
  res.json(order);
});

    Answering 404 instead of 403 avoids confirming that someone else's order exists.

    How to check if your app has this problem

    1. 1Log in as user A and copy the address of one of their private pages, for example /orders/123.
    2. 2Log in as user B and open that same address. You should be refused.
    3. 3List your admin-only actions and try calling them as a normal user.

    The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.

    Run a free scan →

    How to fix it

    1. 1On every route that returns or changes data, check that the data belongs to the current user.
    2. 2Check roles on the server for admin actions. Hiding a button is not enough.
    3. 3Where you use a database with row level security, put the ownership rule there as well.
    4. 4Test with two accounts, then run a check again.
    FIX PROMPT · PASTE INTO YOUR AI TOOL

    Review every API route and database query in my project. For each one that returns or changes user data, make sure the code checks that the record belongs to the logged-in user, and that admin-only actions check the user's role on the server. Add the missing checks and list what you changed. Don't change anything else.

    Check if your app has this problem

    Paste your website and we'll check for authentication vs authorization issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.

    Last updated

    Related terms

    Need help?

    Not sure what this means for your app? Our team will explain it in plain English.

    Contact support