Authn vs Authz

Who you are vs what you may do — see both on 127.0.0.1:8812.

Authn vs Authz• Audio Walkthrough

00:00/03:34

Visual · authn_vs_authz

Authn = identity. Authz = permission. 127.0.0.1:8812.

Passing authn and failing authz is not a “weird 401.” It is the most important distinction in API security.

Authentication (authn) answers who is calling. Authorization (authz) answers whether that subject may touch this object or action. Broken Object Level Authorization (later modules) is an authz failure after authn succeeded. If you conflate the two, you will misread every status code. Original Cyberlium. On 127.0.0.1:8812, a valid lab token may still receive 403 on /admin. You will NOT brute-force authz on stranger apps, not sqlmap “to become admin,” not phish for higher-privilege tokens. Next: Auth Lab — Keys and Bearer.

1. Two questions, two failure modes

No credentials → usually 401. Valid credentials, wrong role/object → usually 403 or a quiet 404. Servers differ; your notes should record what YOUR lab does.

Authn bugs include weak passwords and stolen bearers. Authz bugs include “any logged-in user can read any id.” Different fixes.

Command guide

Try these commands — Two questions, two failure modes

═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)

Authn vs Authz — https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html 401 vs 403 — https://developer.mozilla.org/en-US/docs/Web/HTTP/Status

═══ INSTALL ═══

Linux (Debian/Ubuntu):

Command — copy this

sudo apt install curl
sudo apt install jq

macOS:

Command — copy this

brew install jq

Windows: Built-in (PowerShell: Invoke-WebRequest)

Command — copy this

choco install jq

═══ LINUX / macOS ═══

Command — copy this

curl -sS -o /dev/null -w "missing creds %{http_code}
" http://127.0.0.1:8812/admin
curl -sS -o /dev/null -w "user on admin %{http_code}
" -H "Authorization: Bearer user-token" http://127.0.0.1:8812/admin
curl -sS -H "Authorization: Bearer admin-token" http://127.0.0.1:8812/admin 2>/dev/null | jq . 2>/dev/null || curl -sS -H "Authorization: Bearer admin-token" http://127.0.0.1:8812/admin

Primary tools to practice this lesson: curl, jq. Reference sites: Authn vs Authz (https://cheatsheetseries.owasp.org/cheatsheets/Authorization_Cheat_Sheet.html); 401 vs 403 (https://developer.mozilla.org/en-US/docs/Web/HTTP/Status). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.

2. Object-level thinking starts here

Even before BOLA module: ask “whose record is /items/7?” Identity alone is not enough. The server must bind the subject to the object.

Practice with two lab personas if the toy supports it — both on loopback, both fictional.

3. Ethics wall

Trying every user id on a production API you do not own is unauthorized access, not studying authz. Stay on 127.0.0.1:8812.

Ship definitions of authn and authz in one sentence each. Quiz will APPLY them.

4. What you ship: crisp authn vs authz definitions plus a 401/403 example

Authn vs authz sentences. Lab evidence: 401 without creds, 403 or deny with valid low-priv token on a privileged path. Dest 127.0.0.1:8812. No stranger id-walking.

5. What you record before the next lesson

Date. Definitions. Status examples. File t13-m03-l03-authn-vs-authz.txt chmod 600.

6. Wrong vs right: stranger APIs vs literacy on systems you own

Worked failure — same API word, opposite target. Right never needs a live shop or classmate token.

Wrong: Enumerate /users/1.9999 on a public app. Call 403 a 401 forever. hydra to “upgrade role.”
Right: Definitions + lab statuses. Next: Auth Lab — Keys and Bearer.

Hands-on Exercise