AuthN vs AuthZ

Beginner45 ptsIdentity

Objective

Separate identity from permission.

MFA checks who you are. Checking if you may delete a user is:

Isolated browser lab. Practice here first — no live targets. Optional deeper practice lives in the Academy library after you finish this room.

Answer panel

Challenge workspace

Complete the room tasks, then submit here to mark the room done.

Hint

AuthZ = permission.

Why this is correct

AuthN identity; AuthZ permission. Deep AuthN practice: Authentication course labs (lab-auth-*). AuthZ (IDOR/RBAC) stays in Web AppSec access-control labs.