Lesson 25 / 32

Authentication, Authorization & Encryption

Q: What does 'encryption in transit' protect against, that 'encryption at rest' does not?

Someone intercepting data as it travels over the network. TLS protects data moving between client and server or between services; at-rest encryption protects stored data on disk. You need both.

Who you are, what you can do, and keeping data unreadable to outsiders.

AuthN vs AuthZ

Authentication confirms identity ('you are Priya') — passwords, tokens, OAuth. Authorization decides what that identity can do ('Priya can read but not delete this order') — roles, scopes, ACLs. Keep them as separate checks; conflating them causes both security bugs and confusing errors.

Auth at scale

Verifying identity on every service with a shared database doesn't scale. Signed tokens (JWT) carry identity and claims that any service can verify locally with a public key — no per-request call to an auth service. Trade-off: revoking a token before it expires is hard.

A wristband at a festival

A JWT is like a festival wristband stamped by the entrance: any staff member can glance at it and know you're allowed in (authentication) and which zones your color permits (authorization), without radioing back to the ticket booth every time.

Quick check: What does 'encryption in transit' protect against, that 'encryption at rest' does not?

Someone stealing the physical disk
Someone intercepting data as it travels over the network
A compromised database backup

Answer

Someone intercepting data as it travels over the network — TLS protects data moving between client and server or between services; at-rest encryption protects stored data on disk. You need both.