Understanding Authorization Before Authentication: Enhancing Web API Security

In this video, we dive into the concept of authorization before authentication, explaining the difference between the two terms and their importance in securing web APIs. We explore a real-world scenario in a development environment and identify a security risk related to blanket authentication. Using the AppMap runtime analysis tool, we analyze the code, trace the authorization process, and uncover the lack of authentication. We discuss mitigation strategies for secure development and highlight the value of using AppMap for early issue detection.

Check out the chapters below to navigate through the content easily.

**00:00 - Introduction**
**00:31 - Understanding Authorization and Authentication**
**01:20 - Identifying Security Risks in Development Environments**
**02:42 - Exploring the AppMap Runtime Analysis Tool**
**03:30 - Analyzing the Code and Finding the Security Violation**
**04:03 - Examining the CanCan Library and Dependencies**
**04:45 - Tracing the Authorization Process**
**05:15 - Identifying the Lack of Authentication**
**07:31 - Mitigation Strategies for Secure Development**
**09:08 - Using AppMap for Early Issue Detection**