‫Authentication and authorization testing, so authentication and authorization are in other great function
‫that modern Web applications provide to it.
‫Authentication is the process of proving the identity of the user or any entity.
‫So that means that users prove that they are who they say they are, and then the application allows
‫them to view and interact with the content.
‫Right.
‫Nowadays, especially, authentication mechanisms are not just used for accessing content.
‫It's also used to personalize content of just about any application.
‫So your account on a Web application is starting to be a strong vector that corresponds to your real
‫world existence, your identity.
‫So guess what?
‫This makes the authentication, of course, way more important today.
‫But for you and me, there are a wide range of technologies available to implement authentication mechanisms
‫so far, HTML form based authentication is the most used one, and in general, Web applications authenticate
‫users with a username and password.
‫But this can vary due to the application security needs.
‫So then after authentication, the application grants permission to users in order to perform several
‫actions, such as viewing files, executing something or whatever it may be.
‫So that's why in this action, we are also going to cover authorization problems.
‫OK, authorization is the process of determining what resources a user service or application has permission
‫to access so it can be defined as an access policy of resources.
‫Authentication and authorization are closely related concepts, but they are not the same.
‫The first term proves the identity of a user website or any entity in any context, but authorization
‫verifies the privileges granted to the authenticated identity.
‫So, for example, once you log into your bank account, you're only authorized to transfer money from
‫your accounts, for instance.
‫Right, if you can do it with another account.
‫This means that there's a serious authorization problem.
‫So in the section we're going to talk about password policy problems, password related issues and brute
‫forcing passwords.
‫Also some problematic usage of captious.
‫And then we're going to cover some authorization problems.