Authentication and authorization testing.
So authentication and authorization are in other great function that modern Web applications provide
to it.
Authentication is the process of proving the identity of the user or any entity.
So that means that users prove that they are who they say they are, and then the application allows
them to view and interact with the content.
Right.
Nowadays, especially, authentication mechanisms are not just used for accessing content.
It's also used to personalize content of just about any application.
So your account on a Web application is starting to be a strong vector that corresponds to your real
world existence, your identity.
So guess what?
This makes the authentication, of course, way more important today.
But for you and me, there are a wide range of technologies available to implement authentication mechanisms
so far, HTML form based authentication is the most used one, and in general, Web applications authenticate
users with a username and password.
But this can vary due to the application security needs.
So then after authentication, the application grants permission to users in order to perform several
actions, such as viewing files, executing something or whatever it may be.
So that's why in this action, we are also going to cover authorization problems.
OK, authorization is the process of determining what resources a user service or application has permission
to access so it can be defined as an access policy of resources.
Authentication and authorization are closely related concepts, but they are not the same.
The first term proves the identity of a user website or any entity in any context, but authorization
verifies the privileges granted to the authenticated identity.
So, for example, once you log into your bank account, you're only authorized to transfer money from
your accounts, for instance.
Right, if you can do it with another account.
This means that there's a serious authorization problem.
So in the section we're going to talk about password policy problems, password related issues and brute
forcing passwords.
Also some problematic usage of captious.
And then we're going to cover some authorization problems.