Authentication and authorisation

Authentication establishes who someone is. Authorisation decides what that person is allowed to do. They are consistently discussed together and are separate mechanisms, which is why they fail separately.

Authentication failures are the loud kind — a stolen password, a session that never expires. Authorisation failures are the quiet kind, and by some distance the more common: a logged-in user changes an identifier in a URL and sees another customer's invoice. The system knew exactly who they were and never asked whether they were entitled to that record.

The defence is to check entitlement on every request that touches a specific object, on the server, using the identity in the session rather than anything supplied by the client. "The interface does not show them that link" is not access control.