Authentication and Authorisation

Authentication

Authentication is the process of verifying the identity of a user using some credentials like username and password. Authentication merely ensures that the individual is who he or she claims to be, but says nothing about the access rights of the individual.

Authorization

The process of granting or denying access to a network resource.  Authorization determines the parts of the system to which a particular identity has access. 

Authentication is required before Authorization.

For e.g. If an employee authenticates himself with his credentials on a system, authorization will determine if he has the control over just publishing the content or also editing it

What is Difference Between HTTP and HTTPS Protocol?

HTTP

Hypertext Transfer Protocol (HTTP) is a protocol used in networking. When you type any web address in your web browser, your browser acts as a client, and the computer having the requested information acts as a server. When client requests for any information from the server, it uses HTTP protocol to do so. The server responds back to the client after the request completes. 

HTTPs

Hypertext Transfer Protocol Secure (HTTPS) is a combination of two different protocols. It is more secure way to access the web. It is combination of Hypertext Transfer Protocol (HTTPS) and SSL/TLS protocol. It is more secure way to sending request to server from a client, also the communication is purely encrypted which means no one can know what you are looking for. This kind of communication is used for accessing those websites where security is required. Banking websites, payment gateway, emails (Gmail offers HTTPS by default in Chrome browser), and corporate sector websites are some great examples where HTTPS protocols are used.

For HTTPS connection, public key trusted and signed certificate is required for the server. These certificate comes either free or it costs few dollars depends on the signing authority. There is one other method for distributing certificates. Site admin creates certificates and loads in the browser of users. Now when user requests information to the web server, his identity can be verified easily.

The main motivation for HTTPS is to provide authentication of the visited website and prevent wiretapping and man-in-the-middle attacks.

Here are some major differences between HTTP and HTTPS:

HTTP	HTTPS
URL begins with “http://”	URL begins with “https://”
It uses port 80 for communication	It uses port 443 for communication
Unsecured	Secured
Operates at Application Layer	Operates at Transport Layer
No encryption	Encryption is present
No certificates required	Certificates required

What are the types of Authentication?

There are three types of Authentication:

1. Windows Authentication: uses the security features integrated into the Windows NT and Windows XP operating system to authenticate and authorize web application users
2. Forms Authentication: allows you to create your own list/database of users and validate the identity of those users when they visit your web site
3. Passport Authentication: uses the Microsoft centralized authentication provider to identify users. Passport provides a way to for users to use a single identity across multiple web applications. To use Passport Authentication in your Web application, you must install the Passport SDK

What is garbage collection?

It is a system where a run-time component takes responsibility for managing the lifetime of objects and the heap memory that they occupy. 

Authentication and Authorisation

Authentication

Authentication is the process of verifying the identity of a user using some credentials like username and password. Authentication merely ensures that the individual is who he or she claims to be, but says nothing about the access rights of the individual.

Authorization

The process of granting or denying access to a network resource.  Authorization determines the parts of the system to which a particular identity has access. 

Authentication is required before Authorization.

For e.g. If an employee authenticates himself with his credentials on a system, authorization will determine if he has the control over just publishing the content or also editing it