Oh might auth!

Authentication - is the process of verfiying the identity of users for our application, Basically it checks for entry ticket for house, It ask the question "we dont know you, who are you ?"

Authorization - is the process of granting access to users for specific resources / actions / permissions, and Authorization checks for entry to specific room of house, It ask the question "we know you but do you have permission?"

To identify someone you need something UNIQUE about them, you can Identify your hb by thier noisy wet chappal, but in for z++ level auth you need something which is generated by truted authority and unique.

So it can, some Gov ID, Phone nums, you can can also generate these unqiue IDs or username for your applications,

user's IDs or username can be public, so we need something which only they would know

to identify we must ask user for things only user would HAVE, KNOW, ARE, for example - user have thier phones, user know thier password/pins, user are "fingerprints", "retina", "face" etc.

As we konw that in most of the applications we use passwords or pins to authenticate ourselfs, So it become extremly import to secure it