Authentication vs Authorization – Java Backend Interview
Fast recall
Quick revision
Core answer
Interview-ready guide
Interview answer
Authentication verifies who or what is making a request. It may check a password at login, validate a bearer token on each request, or verify a client certificate. Spring Security represents the successful result as an Authentication object in the SecurityContext.
Authorization is the separate decision about what that principal may do. It can check a role, a fine-grained authority, resource ownership, or method arguments. For example, a signed-in customer may be authenticated but still fail authorization when requesting another customer's order.
For protected APIs, missing or invalid credentials commonly lead to 401, while an authenticated user without the required permission commonly receives 403. Public endpoints are the useful exception to the simple “authentication always comes first” rule: Spring can authorize anonymous access without requiring a login.
Authentication vs Authorization – Java Backend Interview
Direct Answer
Authentication verifies an identity, usually by checking a password, token, certificate, or another credential. Authorization decides whether the current principal—including an anonymous principal—may perform an action. In a protected API, failed or missing authentication commonly leads to 401, while an authenticated principal without permission commonly receives 403; public resources can be authorized without a login.
Check your understanding
Answer these without looking back at the article.
- Which HTTP status code maps to authentication failure vs authorization failure?
- In Spring Security, where does the Authentication object get created and used?
- Can authorization ever happen before authentication?
Looking for a structured roadmap?
Every module on this page is also part of the full Java backend interview track.