Module Overview

What You’ll Learn

• Explain the difference between authentication and authorization
• Add a role to a user, and check it in middleware
• Restrict specific routes to specific roles

💡 Why this matters: Modules 2 and 3 answered “who is this?” Authorization answers a different question: “is this person allowed to do this?” A logged-in user and an authorized user aren’t the same thing, this module covers the difference concretely.

What’s Covered

• Authentication versus authorization, two distinct problems, often confused.
• Adding roles to a user, a simple role field on the user model.
• Role-checking middleware, rejecting a request from the wrong role.
• Combining authentication and authorization, one route, both checks.

Hands-On

By the end of this module, you’ll have routes that are not just login-protected, but role-restricted, an admin-only route that correctly rejects a logged-in, non-admin user.

Next module: input validation, making sure the data reaching these routes is actually valid.