Authentication is the process of verifying who a user or system is before access is granted.
Authentication checks an identity claim against one or more credentials, such as a password, security key, or trusted identity provider.
The result is an answer to “Who is this?” It does not by itself decide which actions that identity may perform.
Think of authentication like showing identification at a building entrance.
The visitor states who they are, presents a credential, and waits while the entrance system checks it.
A successful check establishes an identity that the rest of the building can use.
Authentication gives a system a trustworthy identity to use in later access decisions.
Check that a user or service controls the claimed credential.
Keep the verified identity available across related requests.
Create a signed or otherwise protected proof for later requests.
Stop requests when credentials are missing, invalid, or expired.
Authentication appears anywhere a system needs to recognize a person, service, or device.
Users sign in before viewing private pages or personal data.
Clients prove which application or service is making a request.
An identity provider authenticates employees across connected tools.
A device proves its identity before connecting to a trusted service.
The password should be checked against a securely stored hash, not stored as readable text. The session or token should also be protected and expire according to the system’s risk.
Authentication succeeds only when the system can verify the presented credential under its current rules.
Authentication establishes identity; authorization uses that identity to decide what the request may do.
Checks who a user or system is.
Checks what that verified identity is allowed to do.
Is evidence used during authentication, such as a password or security key.
A successful login does not automatically grant access to every resource or action.
| ENGLISH TERM | 中文 | SIMPLE ENGLISH | 中文小白理解 |
|---|---|---|---|
| Authentication | 身份认证 | Checking who a user or system is. | 检查用户或系统到底是谁。 |
| Identity | 身份 | The user, service, or device represented by a request. | 请求背后代表的用户、服务或设备。 |
| Credential | 凭证 | Information used to prove or support an identity claim. | 用来证明身份或支持身份声明的信息。 |
| Password | 密码 | A secret value used to help prove a user’s identity. | 帮助证明用户身份的一串秘密字符。 |
| Session | 会话 | Server-side state that remembers a verified identity across requests. | 服务器记住已验证身份的一段状态。 |
| Token | 令牌 | A protected value that represents a verified identity or granted access. | 代表已验证身份或已授予访问权的一段受保护信息。 |
| Authorization | 授权 | Checking what an identity is allowed to do. | 检查这个身份可以执行哪些操作。 |
Authentication answers “Who are you?” by verifying a user, service, or device.
It creates a trusted identity that later authorization checks can use.