Authentication versus authorization in Express

WHAT THIS TESTS Whether you understand two distinct security concerns that are often confused, and can map them to the right HTTP semantics and middleware order.

A GOOD ANSWER COVERS Authentication establishes identity: the user proves they are who they claim by presenting credentials such as a password, an API key, or a signed token. Authorization, which happens afterward, determines whether that established identity is permitted to perform the requested action on the requested resource. In an Express app these are typically separate middleware. The first verifies a session cookie or JWT and attaches req.user. A second checks whether req.user has the role or ownership required for the route. The HTTP mapping matters: 401 Unauthorized means not authenticated (no or bad credentials), while 403 Forbidden means authenticated but not permitted.

COMMON WRONG ANSWERS Using the words interchangeably, assuming a logged-in user automatically has access to everything, or swapping the meanings of 401 and 403.

LIKELY FOLLOW-UPS Which status code to return when, how to implement each as middleware, where role checks live, and how ownership checks differ from role checks.

ONE CONCRETE EXAMPLE A user logs in and receives a JWT; presenting it on later requests is authentication, and req.user gets populated. When that user calls DELETE /api/users/42, an authorization middleware checks whether req.user.role equals admin or req.user.id equals 42. A normal user is authenticated yet still rejected with 403 because they lack the permission, not the identity.