What is authentication vs authorization?

• Authentication: Verifying the identity of a user (Who are you?)
• Authorization: Determining if the authenticated user has permission to perform an

action (What are you allowed to do?)

In ASP.NET Core, both are handled via middleware and attributes like [Authorize], roles,

and policies.