
Anna
238 posts




🧵 Day 25/30 — #SystemDesign Authentication and Authorization sound similar, but they solve completely different problems in backend systems. Authentication answers: “Who are you?” The system verifies identity using passwords, OTPs, sessions, JWTs, OAuth, biometrics, etc. Authorization answers: “What are you allowed to do?” After login, the system checks permissions, roles, and access levels before allowing actions like deleting users, accessing admin routes, viewing private data, or triggering payments. ⸻ A user can be authenticated but still not authorized. Example: You log into Netflix successfully → Authentication ✅ Trying to access Netflix admin dashboard → Authorization ❌ This distinction becomes critical in production systems because bad authorization design can expose sensitive data even when authentication is secure. Modern systems often use: → JWT / Sessions for authentication → RBAC (Role-Based Access Control) for authorization → OAuth for third-party identity access → Middleware/API Gateways for permission enforcement ⸻ Real companies implement authorization very deeply: → Google Docs controls document-level permissions → AWS IAM manages cloud access policies → GitHub controls repo/team permissions → Banking apps enforce strict action-based authorization Authentication gets users into the system. Authorization decides what power they actually have inside it. #30DaysOfSystemDesign #Authentication #BackendEngineering













- Google Maps uses graph ML to predict ETA - Netflix uses graph ML in recommendation - Spotify uses graph ML in recommendation - Pinterest uses graph ML in recommendation Here are 6 must-know ways for graph feature engineering (with code):











