> the distinction between authentication and authorization
Distinction which is totally useless in practice as you certainly won’t have authorization without authentication.
Distinction which is totally useless in practice as you certainly won’t have authorization without authentication.
At that point, the separation is more about capabilities/responsibilities than "does it happen?"
(This is what I do in my day job.)