Authorization answers the question: “What are you allowed to do?” A user may be correctly logged in, but the app still must not let them read someone else’s orders, change another profile, or enter administration.
Why it matters: Many serious web application bugs are not in loginThe information used to log in to a service, usually username, email, password, code, or security ke... More, but in permission checks.
