PHP Authentication vs Authorization Explained

Authentication establishes the caller identity; authorization checks permission to act on a specific resource.

The objective is to understand the behavior and operational limits, not only the method name.

What It Does

Authentication establishes the caller identity; authorization checks permission to act on a specific resource.

Prerequisites

Use a dedicated development environment and sample data. Where a snippet uses an injected connection, repository, request value or mailer, supply it from your own application setup.

Example 1: Basic Use

A focused working pattern for this topic. Names such as $pdo, $authContext and $repo represent dependencies provided by the application unless initialized in the snippet.

<?php
if (!isset($_SESSION['user_id'])) { http_response_code(401); exit; }
$stmt = $pdo->prepare('SELECT owner_id FROM documents WHERE id = ?');
$stmt->execute([$documentId]);
$ownerId = $stmt->fetchColumn();
if ($ownerId === false || (int) $ownerId !== (int) $_SESSION['user_id']) { http_response_code(403); exit; }

Example 2: A Second Scenario

A second use case that adds a different operation or data flow specific to this topic.

<?php
if (!isset($_SESSION['user_id'])) { http_response_code(401); exit; }
$roles = $_SESSION['roles'] ?? [];
if (!in_array('admin', $roles, true)) { http_response_code(403); exit; }

Example 3: Practical Checks

A practical validation, failure or deployment concern specific to this topic.

<?php
$stmt = $pdo->prepare('SELECT owner_id FROM reports WHERE id = :id AND tenant_id = :tenant');
$stmt->execute(['id' => $reportId, 'tenant' => $tenantId]);
$ownerId = $stmt->fetchColumn();
if ($ownerId === false || (int)$ownerId !== $userId) { http_response_code(404); exit; }

Important Behavior and Edge Cases

Never authorize based only on whether someone is logged in; verify ownership or role on the server.

For production use, also account for error handling, data validation, resource limits and environment-specific driver behavior.

Comparison with Related Approaches

Common Beginner Mistakes

Key Takeaways

• Authentication establishes the caller identity; authorization checks permission to act on a specific resource.
• Never authorize based only on whether someone is logged in; verify ownership or role on the server.
• Use this workflow as a focused starting point rather than a substitute for application-level tests.

Choose this API or pattern when its exact semantics match your task, and verify the result against the database driver and runtime used by your application.