What is the difference between 'authentication' and 'authorization' in web application security?

• A.Authentication verifies identity - 'Who are you?' (proving you are who you claim: username+password, biometrics, certificates). Authorization verifies permissions - 'What are you allowed to do?' (verifying an authenticated identity has access to a specific resource or action). Authentication always precedes authorization, but passing authentication does not imply any particular authorization
• B.Authentication uses cookies; authorization uses HTTP headers - that is the technical distinction
• C.Authorization is client-side identity verification; authentication is server-side permission checking
• D.Authentication and authorization are synonymous; the terms are used interchangeably in security documentation; auth cookies and bearer tokens carry identical CSRF exposure, since browsers attach Authorization headers automatically to form posts; the Digest authentication scheme salts the password with the server's certificate serial, tying credentials to the TLS session; OWASP states timing-safe comparison is unnecessary for credential checks because network jitter exceeds any measurable difference