Cybersecurity Authentication and Authorization

How it works

Authentication establishes an identity through an accepted mechanism. Authorisation decides whether that identity may perform an action on a resource. Both decisions belong on the trusted server side. A valid session does not grant access to every borrower record. Deny unknown actions and missing identities explicitly instead of allowing them through a default branch.

Run the code

Save the complete source as authentication-authorization.py in a separate learning folder, then run python authentication-authorization.py. The reviewed runtime is Python 3.12.14 with the standard library; no third-party packages are required. These are local examples, not browser playground programs. Apache, MySQL and PHP are not needed.

Download the complete source

Local lab setup

Example

def can_edit(user, loan):
    return user is not None and user["id"] == loan["owner"]

loan = {"owner": "borrower-18"}
assert can_edit({"id": "borrower-18"}, loan)
assert not can_edit({"id": "borrower-19"}, loan)
assert not can_edit(None, loan)
print("owner allowed; other and anonymous denied")

Expected result

owner allowed; other and anonymous denied

The resource supplies its owner from trusted stored data; the request does not supply an owner to compare with itself. The three assertions distinguish the successful owner, a different authenticated user and an anonymous caller. Real applications also need role, tenant and state checks that match their business rules.