Hacker News new | ask | show | jobs
by hinkley 1004 days ago
Few contractions foment confusion as much as “auth”. Don’t do it.
2 comments

authn vs authz: Authentication vs Authorization

authn/authentication: user proves who they are, with username/password or otherwise

authz/authorization: based on who the user is, system determines what they are allowed to do, via group membership or otherwise

authz may be confusing to non USA English speakers. I wouldn't make the connection without it spelled out to me. Unfortunately I don't have a better suggestion because auths as short for authorisation is probably worse.
If you work with computers (rather than using them) and don't default to USA English when discussing and using them you are likely in for a bad time.
I think it is less confusion than just calling it auth. I have read many articles about basic auth vs oauth. But the auth here isn't the same.
You can't pronounce authn and authz very well, but to be perfectly honest I'm not sure if that falls under the 'pro' or 'con' column.
I think it's a pro. in saying auth-enn and auth-zee (zed), it's clear which of the two you're talking about.
To me they look like the kind of abbreviations I'd only do when writing. I just say authentication or authorisation when reading them (out loud or in my own mind)
TBH, we'd be better if without any of the contracted forms.
the only exception is if you mean both, but even that's confusing if the context isn't clear.

spell them out or use authn/authz.