This content has been automatically translated from Ukrainian.
Authorization is the process by which a website, application, or other system determines what data and functions a specific user has access to.
In simpler terms, the system already knows who you are and now decides: what exactly you are allowed to see and do.
For example, after logging into an online bank, you can view your own accounts and perform transactions, but you do not have access to other clients' accounts. In a corporate service, a regular employee can view documents of their department, while an administrator can add users and change settings. These are the kinds of restrictions that authorization defines.
Authorization is not just logging into an account
In everyday language, authorization is often referred to as simply logging into a site: “log in with username and password”. This is a clear and very common usage, but from a technical perspective, the process consists of at least two parts.
First, authentication occurs — the system checks who is trying to log in. This can involve a password, a one-time code, biometrics, a passkey, or another method of verification.
After that, authorization takes effect — the system checks what rights the already recognized user has.
The scheme can be reduced to two questions:
Authentication: “Who are you?”
Authorization: “What are you allowed to do?”
For example, the password helped confirm that the account belongs to you. This is authentication. The ability to edit your own profile after logging in, but not someone else's, is the result of authorization.
How authorization works
After a successful login, the system associates the user with certain access rights. These may depend on the role, account type, organization settings, subscription, or specific permissions.
Conditionally, the site may know:
- this user can read the document;
- this user can edit it;
- this user can delete files;
- this user has access to the administrative panel;
- this user sees only their own data.
Therefore, two people can be successfully logged into the same service at the same time but have completely different capabilities.
Authorization applies not only to people. Programs, mobile applications, APIs, and other services can also receive rights to perform certain actions on behalf of the user.
Example with a social network
You log into your account on a social network.
After logging in, you can edit your own posts, change profile settings, view private messages, and manage your photos.
At the same time, you cannot open another user's private correspondence or change their profile.
The system has already determined who you are, and authorization has set the boundaries of access.
Even within one account, there can be additional restrictions. For example, the owner of a company page can grant another person the right to post, but not allow them to change settings or manage other administrators.
Authorization in work services
The role of authorization is particularly noticeable in corporate systems.
Imagine a service where an accountant, a manager, and a system administrator work. Each has their own account and can successfully log into the system.
But the rights differ.
The manager works with orders and clients. The accountant has access to accounts and financial documents. The administrator manages users and service settings.
If the rights are set correctly, the employee receives only the access they need to perform their job. This approach reduces the risk of accidental data deletion, information leakage, or abuse of access.
What it means to "Allow access" to an application
Another common example of authorization arises when one service requests access to another.
For example, you connect a third-party application to your Google account. A list of permissions may appear on the screen:
- viewing email address;
- access to calendar;
- reading files;
- creating or editing certain data.
By clicking “Allow,” the user grants the application specific rights.
This is one form of authorization: the third-party program does not necessarily receive your password. Instead, it receives permission to perform defined actions.
That is why, before confirming such a request, it is important to look not only at the name of the application but also at what specific rights it is requesting.
A calculator, for example, probably does not need access to your email or contacts. If a simple service requests significantly more permissions than necessary for its operation, it is a reason to hesitate before confirming.
Why authorization is important for security
A strong password protects the account from unauthorized access, but that is not enough. It is equally important to correctly determine what a user can do after logging in.
If any registered user had unrestricted access to the system, the mere act of password verification would be almost meaningless.
Authorization creates boundaries between users, data, and functions.
For example, it should not allow:
- a regular user to open someone else's private data;
- an employee without the appropriate authority to change financial information;
- a third-party program to access more data than it was allowed;
- a user to perform administrative actions without the appropriate role.
One of the basic principles of information security is to grant users and programs only the minimum necessary rights.
If an application only needs to read the calendar, it does not need permission to delete events. If an employee needs to view a document, it is not necessary to give them the right to delete it.
What the user can do themselves
Most of the authorization mechanisms are configured by the service itself, but some rights are controlled by the user.
It is worth periodically checking which applications are connected to important accounts — Google, Microsoft, Apple, social networks, and other services.
If you no longer use an application, its access can be revoked.
It is also important to read permission requests carefully. Especially if the application wants access to email, files, contacts, photos, calendar, or other private data.
Granting an application access can often be done with a single click. But this permission may remain active much longer than you remember about the application itself.
What happens after logging out
After logging in, the site usually creates a session, which means you do not have to enter your password on every page.
While the session is active, the service remembers which user is working with it and applies the appropriate access rights to their actions.
When the user logs out, such a session should end. That is why, on shared or other people's devices, it is important not just to close the browser tab, but to use the “Log out” button.
This is especially true for email, banking services, work systems, and other accounts with sensitive data.
Authorization, authentication, and verification — in brief
These three terms are often found together, but they denote different processes.
Authentication confirms who you are.
Authorization determines what you are allowed to do.
Verification checks the validity of certain data — for example, an email address, phone number, or document.
Therefore, entering a password during login is primarily authentication. Access after logging in only to your own data is authorization. And an email with a confirmation link for your email address is verification.
