更详细的答案请参考:https://www.okta.com/identity-101/authentication-vs-authorization/

正如身份验证vs授权所言:

Authentication is the mechanism whereby systems may securely identify their users. Authentication systems provide an answers to the questions: Who is the user? Is the user really who he/she represents himself to be? Authorization, by contrast, is the mechanism by which a system determines what level of access a particular authenticated user should have to secured resources controlled by the system. For example, a database management system might be designed so as to provide certain specified individuals with the ability to retrieve information from a database but not the ability to change data stored in the datbase, while giving other individuals the ability to change data. Authorization systems provide answers to the questions: Is user X authorized to access resource R? Is user X authorized to perform operation P? Is user X authorized to perform operation P on resource R?

参见:

Wikipedia上的身份验证与授权

认证是验证实体身份的过程。例如

Webserver每次都要求用户输入登录名/密码，以验证创建该帐户的用户是否是现在正在访问该帐户的用户。

授权是允许每个实体获得所需数量的服务/资源的过程。例如

On blogging site (eg. medium.com) users can create an account and write a post and publish. And users can read all posts published by others as well. Here the blogging server first authenticates the user with the user login credentials (login/password) and then it authorizes to read all others post and write/modify the post only created by the user. Here authorization is used by the server to limit which all post each user can modify. Users can create a free google account by which google server provides free services like mail, calendar, chat, drives etc. But the storage provided for all these services to free users are 15GB (as of now). User can pay a monthly or annual fee to google server to increase the storage space. Here google server authorizes every authenticated user to limit the amount of resource usage.

在当今的互联网中，授权被广泛用于对客户端施加访问限制。

身份验证是确定某人确实是他们所声称的那个人的过程。 授权是指决定谁可以做什么的规则。例如，亚当可能被授权创建和删除数据库， 而Usama只被授权阅读。

这两个概念是完全正交和独立的，但它们都是安全设计的核心，如果其中任何一个概念都不正确，就会导致妥协。

就web应用程序而言，简单地说，身份验证是指你检查登录凭证，看看你是否识别出用户已登录，而授权是指你在访问控制中查看是否允许用户查看、编辑、删除或创建内容。

简而言之，请。: -)

身份验证=登录名+密码(你是谁) 授权=权限(你被允许做的事情)

简短的“auth”最有可能指的是第一个或两者。

混淆是可以理解的，因为这两个词听起来很相似，而且概念经常密切相关并一起使用。此外，如前所述，常用的缩写Auth也没有帮助。

其他人已经很好地描述了身份验证和授权的含义。这里有一个简单的规则来帮助区分这两者:

身份验证验证您的身份(或真实性，如果您喜欢) 授权验证您的权限，即您访问和可能更改某些内容的权利。