Basics of Web Application Security: Authorize Actions

Authentication means you know who your user is, protecting their session
ensures that information stays correct. Now Cade and Daniel move on to authorization:
checking that users only do what they are allowed to do. Authorization should
always be checked on the server and should deny by default. Actual authorization
schemes are domain-specific, but some common patterns help get you started.

more…