Authentication answers who you are; authorization answers what you may do. It must be checked on the server for every function and every object, not only at login.
Authorization
Deciding what an already identified caller is allowed to do.
Authentication answers who you are; authorization answers what you may do. It must be checked on the server for every function and every object, not only at login.