Developing Java Applications with Spring and Spring Boot

Authentication versus authorization

Spring Security operates on two fundamental concepts--authentication and authorization.

These two concepts can be described as follows:

• Authentication: This defines who you are
• Authorization: This defines what you are allowed to do

The first step in any security system is to confirm the user's identify. This often involves a username and a password, but these credentialed bits can be stored in many different systems, including relational databases, directory servers, certificates, and other things. However, these are implementation details that surround verifying someone's identity. Until we know who you are, we can't make any determination.

HTTP Basic, HTTP FORM, and other forms of authentication are ...