https://sh1nn.is-a.dev/tags/access-control/Recent content in Access-Control on Sh1nn's blog - Penetration Tester and Security ResearcherHugoen-usSun, 19 Jul 2026 00:00:00 +0000https://sh1nn.is-a.dev/posts/authentication-authorization-from-internal-mechanics-to-deep-testing/Sun, 19 Jul 2026 00:00:00 +0000https://sh1nn.is-a.dev/posts/authentication-authorization-from-internal-mechanics-to-deep-testing/<h1 id="authentication-vs-authorization-from-internal-mechanics-to-deep-testing">Authentication vs Authorization: From Internal Mechanics to Deep Testing</h1> <blockquote> <p>This article is intended only for labs, systems you own, or targets you are explicitly authorized to test.</p> </blockquote> <h2 id="introduction">Introduction</h2> <p>Authentication and authorization are often taught through two short definitions:</p> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;-webkit-text-size-adjust:none;"><code class="language-text" data-lang="text"><span style="display:flex;"><span>Authentication = Who are you? </span></span><span style="display:flex;"><span>Authorization = What are you allowed to do? </span></span></code></pre></div><p>Those definitions are correct, but they are not enough for serious penetration testing. To test deeply, we need to understand the entire chain:</p>