Authorization

ELI5 — The Vibe Check

Authorization is deciding what you're allowed to do after you've proven who you are. The bouncer let you in (authentication), but now the VIP host decides if you can sit in the VIP section (authorization). You're in the building, but not everywhere in it.

Real Talk

Authorization determines what resources or actions an authenticated user is permitted to access. It typically involves roles, permissions, and access control lists (ACLs) that define what each user or group can do.

Show Me The Code

// Checking if user has permission to delete
if (!user.roles.includes('admin')) {
  throw new Error('Not authorized to delete posts');
}

When You'll Hear This

"The endpoint needs authorization — only admins should call it." / "Authorization error: you don't have permission to view this."