2

I think a lot of new comers get confused because these two terms look and sound similar:

  • Authentication
  • Authorization

I think "Authentication" is well known, I will use this term.

But for some docs I currently write I would like to use an alternative word for "Authorization".

What's the best synonym for "Authorization"?

( ... weeks later: I will use "Permission Checks" as synonym for "Authorization")

Authentication and Authorization get confused very often. I want a clear distinct solution which is easy to understand for beginners.

  • 2
    Depending on context, you could use permission. – CodesInChaos Dec 14 '17 at 8:28
  • 3
    Obligatory xkcd. – Robzor Dec 14 '17 at 8:35
  • @CodesInChaos yes, "Permission" sound good. But strictly speaking this word is not a synonym for "Authorization".... maybe "Checking Permissions" ... But I am unsure since I am not a native speaker. Dear CodesInChaos please write your comment as answer. Thank you. – guettli Dec 14 '17 at 20:36
  • Access control is a good alternative – David Brossard Jan 10 '18 at 14:11
  • 1
    +1 I'll add that sometimes both terms get shortened to "auth", which makes it even more difficult to tell them apart! – Andres F. Jan 25 at 14:16
14

Using another word for "Authorization" or "Authentication" isn't helpful for writing documentation. Even though they're obscure, these two are already the most common words for those things, and any one-word synonym will make your text even less understandable.

Instead you should use phrases to express the same meaning. Authentication means proving to the system who you are, while authorisation is about what you're allowed to do. Therefore, you should write about proving your identity and about allowing actions, rather than about "authorising someone for something".

3

The docs of the Django REST framework use the word "Permissions" and "Permission Checks" instead of "Authorization".

Note: Don't forget that authentication by itself won't allow or disallow an incoming request, it simply identifies the credentials that the request was made with. For information on how to setup the permission polices for your API please see the permissions documentation.

Source http://www.django-rest-framework.org/api-guide/authentication/

...

Permission checks are always run at the very start of the view, before any other code is allowed to proceed. Permission checks will typically use the authentication information in the request.user and request.auth properties to determine if the incoming request should be permitted.

Source: http://www.django-rest-framework.org/api-guide/permissions/

  • Permission checks on resources are a mechanism for managing authorisation, but role based, capability based, and other authorisation mechanisms also exist. – Pete Kirkham Jan 9 '18 at 11:01
  • @PeteKirkham "capability based" that is a good point! Do you mean the capability of the client (he is not able to do it, or should not do it) or of the server (like the http status code 503 "service unavailable" (maybe because there is too much load))? – guettli Jan 10 '18 at 15:01
  • 1
    It has a well defined meaning - en.wikipedia.org/wiki/Capability-based_security - on the web, the closest probably would be having a cryptographic token or API key. e.g. a one-time reset password link authorises a client to change the password without the client authenticating as (an a agent for) the user whose password it is. – Pete Kirkham Jan 10 '18 at 15:26
  • I read the wikipedia article. "A capability (known in some systems as a key) is a communicable, unforgeable token of authority." ok, then I think "capability based" is a way to do authorization with a key and not with user+password. It is a sequence: first auth, then perm checking. – guettli Jan 11 '18 at 14:57
  • It can be, but there is no necessity for separate authentication or a mapping of identity to permissions - e.g. a system where it checks if a key matches a hash on the file, and if it does allows it to be downloaded, would be capability based without either, the capability being represented by the key and the URL. – Pete Kirkham Jan 11 '18 at 15:06
0

I agree with Kilian that these two words are the most common for what they describe and that using other words will reduce understandability even more.

But rather than using phrases instead of these words, i suggest this: create a glossary for your documentation (which is also useful for many other terms). Include Authentication and Authorization. When a reader gets confused about these two, they hopefully have noticed the glossary and will use it to clear the confusion.

  • 1
    Authentication and Authorization get confused very often. I want a clear distinct solution which is easy to understand for beginners. – guettli Jan 25 at 8:50
0

If I were to be targeting a lay-person audience instead of technical, I would choose the words "Identification" and "Authorization."

If the audience is technical, I would stick with "Authentication" and "Authorization."

  • I am not very clever. Conditions make me nervous. – guettli Jan 25 at 13:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.