What’s on the AuthN vs AuthZ poster
AuthN — who are you against AuthZ — what may you do, side by side.
- AuthN — who are you: Passwords, passkeys, biometrics
- AuthN — who are you: Multi-factor: something you know, have, are
- AuthN — who are you: Produces a session or a token
- AuthN — who are you: HTTP 401 when it fails
- AuthN — who are you: Happens once, at the start
- AuthZ — what may you do: Roles, permissions, policies
- AuthZ — what may you do: Checked on every single request
- AuthZ — what may you do: Ownership checks: is this row yours?
- AuthZ — what may you do: HTTP 403 when it fails
- AuthZ — what may you do: Happens continuously
- Broken authorisation is the more common breach: a valid user reaching another user's…
Authorise on the server against the session's identity. A client that sends its own user id is not a security control.
Questions about the AuthN vs AuthZ poster
- What’s on the AuthN vs AuthZ poster?
- AuthN — who are you against AuthZ — what may you do, side by side. AuthN — who are you: Passwords, passkeys, biometrics; AuthN — who are you: Multi-factor: something you know, have, are; AuthN — who are you: Produces a session or a token; AuthN — who are you: HTTP 401 when it fails; AuthN — who are you: Happens once, at the start; AuthZ — what may you do: Roles, permissions, policies; AuthZ — what may you do: Checked on every single request; AuthZ — what may you do: Ownership checks: is this row yours?; AuthZ — what may you do: HTTP 403 when it fails; AuthZ — what may you do: Happens continuously; Broken authorisation is the more common breach: a valid user reaching another user's…. Authorise on the server against the session's identity. A client that sends its own user id is not a security control.
- Who is the AuthN vs AuthZ poster for?
- AuthN vs AuthZ belongs to the Computing section rather than to a school year, because computing is not something one grade owns. Anyone learning security can pin it up — a beginner, a student mid-course, or someone revising years later.
- When should you use the AuthN vs AuthZ poster?
- Authentication is the door. Authorisation is which rooms you may enter. A wall chart earns its place by being glanceable from where the work is happening, so AuthN vs AuthZ belongs on the wall where that computing work actually happens, within glancing distance, rather than filed away.
- What other posters go with AuthN vs AuthZ?
- Secrets, Hashing vs Encryption and HTTPS & TLS sit alongside AuthN vs AuthZ in the Computing section. Printed together they make a wall rather than a single sheet, which is how a reference set actually gets used.SecretsHashing vs EncryptionHTTPS & TLS
- Is the AuthN vs AuthZ poster free to download and print?
- Yes. AuthN vs AuthZ downloads as a free PDF with no account, no email and no watermark, like everything else in the Computing section. Print as many copies as you like for a home, a classroom, a library or a tutoring group; reselling the file is the only thing the licence rules out.Read the licence
- What size does the AuthN vs AuthZ poster print at?
- AuthN vs AuthZ is a vector PDF laid out for US Letter, and prints on A4 with Fit to page — the same file, no separate download. Because every mark on it is drawn rather than photographed, it stays sharp enlarged to A3, A2 or A1 at a copy shop. Colour carries emphasis only, so a greyscale print of AuthN vs AuthZ loses nothing.Printing guide
Related posters
Charts that sit alongside AuthN vs AuthZ on the same wall.
Browse every Computing poster, or start from the full catalogue.