Authorization on dplabs — Software Engineering & Technology Consultancy

Secure by Default: APIs That Are Hard to Misuse

Mon, 29 Jun 2026 00:00:00 +0000

Security by default is a design principle, not a feature list. An API is secure by default when using it correctly produces secure behavior automatically, and producing insecure behavior requires deliberate effort.

Most security failures are not the result of sophisticated attacks on well-designed systems. They’re the result of developers using APIs incorrectly, making incorrect assumptions about what defaults are safe, or forgetting to add security checks that should have been built in.

Authentication vs Authorization: Two Problems People Keep Conflating

Mon, 24 Mar 2025 00:00:00 +0000

“Authentication” and “authorization” are often used interchangeably. They’re not the same problem, they’re not the same solution, and conflating them produces security architectures that fail in predictable ways.

The Definitions That Matter

Authentication: verifying who someone is.

A request is authenticated when the system has verified that the claimed identity (user, service) is legitimate. After authentication, you know who is making the request.

Authorization: determining what someone is allowed to do.