Hands-On RESTful Web Services with Go - Second Edition

Authentication versus authorization

Authentication is the process of identifying whether a client is genuine or not. When a server authenticates a client, it checks the username/password pair and creates a session cookie/JWT.

Authorization is the process of evaluating whether a user has access to a given resource. In cloud services, there should be a mechanism to limit the scope of resource access for certain users/roles, and authorization enables it.

In simple words, authentication decides who is the customer of a service, and authorization determines what are the customer's boundaries for resource access.

OAuth 2.0 is a protocol for authenticating multiple clients to a service, whereas JWT is a token format. We need to encode/decode JWT ...