Authentication, Authorisation and Least Privilege
Two ideas that sound alike:
- Authentication: proving who you are (password, fingerprint, code).
- Authorisation: deciding what you are allowed to do once identified.
Good systems apply the principle of least privilege: every person and program gets only the access needed for the job, nothing more. A broken or stolen account then does limited damage. A common method is role-based access control (RBAC): permissions attach to roles, and users get roles.
Always check authorisation on the server for every request. Hiding a button in the interface is not security.
Examplepython
Quick check
Least privilege means...
Your turn: write the code
Using the permissions dictionary, print the sorted list of roles that are allowed to 'edit_course'.
Finish the quick check (and any code exercise) to complete this lesson, or mark it done yourself.
Tip: use the left and right arrow keys to move between lessons.