Authorization Basics Interview Questions and Answers
Top 10 Authorization interview questions with detailed answers, production scenarios, and enterprise best practices.
Authorization is one of the most important security concepts in enterprise applications. After a user is authenticated, the application must determine what resources and operations that user is allowed to access. Authorization ensures users can perform only the actions permitted by their assigned roles or permissions.
Q1. What is Authorization?
Answer
Authorization is the process of determining what an authenticated user is allowed to access or perform.
It answers the question:
"What are you allowed to do?"
Authorization always happens after successful authentication.
Example
User Login
↓
Authentication Successful
↓
Authorization Check
↓
Access Granted / Access Denied
Example
A customer can:
- View account details
- Transfer money
- Download statements
A customer cannot:
- Create new users
- Delete customer accounts
- View all customer records
Q2. What is the difference between Authentication and Authorization?
Answer
Authentication verifies identity, whereas authorization verifies permissions.
| Authentication | Authorization |
|---|---|
| Who are you? | What can you access? |
| Identity Verification | Permission Verification |
| Happens First | Happens After Authentication |
| Login | Access Control |
Example
Authentication
Username: john
Password: ********
Authorization
Role: CUSTOMER
Allowed:
✓ View Account
✓ Transfer Money
✗ Delete Users
Interview Tip
A user cannot be authorized until they have been authenticated.
Q3. Why is Authorization important?
Answer
Authorization protects sensitive resources by ensuring users access only what they are permitted to access.
Without authorization:
- Any authenticated user could access sensitive data.
- Customers could view other customers' information.
- Employees could perform administrator actions.
- Critical business operations could be abused.
Production Example
Admin Dashboard
↓
Administrator
↓
Access Granted
-----------------
Customer
↓
Access Denied
Q4. What are the common authorization models?
Answer
Enterprise applications commonly use:
- Role-Based Access Control (RBAC)
- Attribute-Based Access Control (ABAC)
- Policy-Based Access Control (PBAC)
- Resource-Based Authorization
- Scope-Based Authorization
Comparison
| Model | Best For |
|---|---|
| RBAC | Enterprise Applications |
| ABAC | Banking & Healthcare |
| PBAC | Cloud Platforms |
| Resource-Based | REST APIs |
| Scope-Based | OAuth2 APIs |
Interview Tip
RBAC is the most widely implemented authorization model.
Q5. What is Role-Based Access Control (RBAC)?
Answer
RBAC grants permissions based on user roles.
Example
| Role | Permissions |
|---|---|
| Customer | View Accounts |
| Teller | Deposit Money |
| Manager | Approve Loans |
| Admin | Manage Users |
Flow
User
↓
Role
↓
Permissions
↓
Access Decision
Benefits
- Easy to manage
- Scalable
- Widely supported
- Supported by Spring Security
Q6. How is Authorization implemented in Spring Security?
Answer
Spring Security provides several authorization mechanisms.
Common approaches include:
- URL-based Authorization
- Method-Level Security
- Role-Based Authorization
- Authority-Based Authorization
- Custom Authorization Logic
Example
@PreAuthorize("hasRole('ADMIN')")
@GetMapping("/users")
public List<User> getUsers() {
return service.findAll();
}
Only users with the ADMIN role can access the endpoint.
Q7. What is the difference between Roles and Permissions?
Answer
A Role is a collection of permissions.
A Permission represents a specific action.
Example
Role
ADMIN
Permissions
CREATE_USER
UPDATE_USER
DELETE_USER
VIEW_USERS
One role can contain multiple permissions.
Interview Tip
Roles simplify permission management by grouping related permissions.
Q8. What are common authorization attacks?
Answer
Common attacks include:
- Broken Access Control
- Privilege Escalation
- Insecure Direct Object Reference (IDOR)
- Forced Browsing
- Horizontal Privilege Escalation
- Vertical Privilege Escalation
Example
Customer changes:
/accounts/1001
to
/accounts/1002
If authorization checks are missing, another customer's account may be exposed.
Q9. What are authorization best practices?
Answer
Follow these best practices:
- Follow the Principle of Least Privilege.
- Validate authorization on every request.
- Never trust client-side roles.
- Use centralized authorization.
- Apply authorization at both URL and method levels.
- Log access-denied events.
- Validate resource ownership.
- Review permissions regularly.
- Remove unused roles.
- Protect administrative endpoints.
Production Example
Request
↓
Authentication
↓
Authorization
↓
Business Logic
↓
Database
Authorization should occur before business logic execution.
Q10. What is the recommended enterprise authorization architecture?
Answer
Enterprise applications implement authorization as multiple security layers.
Production Architecture
User
│
HTTPS
│
API Gateway
│
Authentication
│
JWT Validation
│
Spring Security Filter
│
RBAC / ABAC Authorization
│
Business Services
│
Database
Senior Interview Tip
Enterprise authorization should include:
- RBAC or ABAC
- Resource-level authorization
- Method-level authorization
- API Gateway security
- OAuth2 scopes
- Least Privilege
- Comprehensive auditing
- Centralized policy management
Authorization should never depend solely on UI restrictions. Every backend request must enforce authorization before accessing protected resources.
Quick Revision
- Authorization determines what a user can access.
- Authentication always happens before authorization.
- RBAC is the most common authorization model.
- Roles contain multiple permissions.
- Never trust client-side authorization.
- Validate authorization for every request.
- Apply the Principle of Least Privilege.
- Protect against Broken Access Control and IDOR.
- Spring Security supports method-level authorization.
- Enterprise applications use layered authorization for stronger security.