\u1ede \u0111\u00e2y m\u00ecnh s\u1ebd kh\u00f4ng \u0111i s\u00e2u chi ti\u1ebft v\u00e0o c\u01a1 ch\u1ebf ho\u1ea1t \u0111\u1ed9ng c\u1ee7a\u00a0authentication v\u00e0 authorization m\u00e0 ch\u1ec9 t\u00f3m l\u01b0\u1ee3t kh\u00e1i ni\u1ec7m c\u01a1 b\u1ea3n c\u1ea7n thi\u1ebft m\u00e0 m\u1ed9t tester n\u00ean bi\u1ebft \u0111\u1ec3 kh\u00f4ng b\u1ecb nh\u1ea7m l\u1eabn gi\u1eefa 2 thu\u1eadt ng\u1eef n\u00e0y.<\/p>\n
1. Authentication<\/strong><\/span><\/p>\n Theo Techtarget \u0111\u1ecbnh ngh\u0129a \u201cAuthentication is a process in which the credentials provided are compared to those on file in a database of authorized users\u2019 information on a local operating system or within an authentication server.\u201d<\/p>\n T\u1ea1m d\u1ecbch Authentication l\u00e0 x\u00e1c th\u1ef1c, n\u00f3 l\u00e0 qu\u00e1 tr\u00ecnh ki\u1ec3m tra danh t\u00ednh c\u1ee7a ng\u01b0\u1eddi d\u00f9ng ho\u1eb7c m\u1ed9t h\u1ec7 th\u1ed1ng kh\u00e1c \u0111\u1ebfn h\u1ec7 th\u1ed1ng hi\u1ec7n t\u1ea1i th\u00f4ng qua m\u1ed9t h\u1ec7 th\u1ed1ng x\u00e1c th\u1ef1c.<\/p>\n M\u1ed9t c\u00e1ch \u0111\u01a1n gi\u1ea3n qu\u00e1 tr\u00ecnh Authentication l\u00e0 \u0111i t\u00ecm c\u00e2u tr\u1ea3 l\u1eddi cho c\u00e2u h\u1ecfi \u201cB\u1ea1n l\u00e0 ai?\u201d<\/p>\n Qu\u00e1 tr\u00ecnh n\u00e0y r\u1ea5t th\u00f4ng d\u1ee5ng trong h\u1ea7u h\u1ebft c\u00e1c CMS li\u00ean quan \u0111\u1ebfn qu\u1ea3n l\u00fd, t\u01b0\u01a1ng t\u00e1c ng\u01b0\u1eddi d\u00f9ng th\u00f4ng qua form \u0111\u0103ng k\u00fd (login form) v\u00e0 n\u00f3 \u0111\u01b0\u1ee3c x\u00e1c th\u1ef1c d\u1ef1a tr\u00ean t\u00ean ng\u01b0\u1eddi d\u00f9ng v\u00e0 m\u1eadt kh\u1ea9u (password-based authentication).<\/p>\n 2. Authorization:<\/strong><\/span><\/p>\n Theo Techtarget \u0111\u1ecbnh ngh\u0129a \u201cAuthorization is the process of giving someone permission to do or have something.\u201d<\/p>\n M\u1ed9t c\u00e1ch hi\u1ec3u \u0111\u01a1n gi\u1ea3n qu\u00e1 tr\u00ecnh Authorization l\u00e0 \u0111i t\u00ecm c\u00e2u tr\u1ea3 l\u1eddi cho c\u00e2u h\u1ecfi \u201cB\u1ea1n \u0111\u01b0\u1ee3c ph\u00e9p l\u00e0m g\u00ec?\u201d<\/p>\n X\u00e9t v\u1ec1 m\u1eb7t logic th\u00ec authorization \u0111\u01b0\u1ee3c th\u1ef1c thi sau khi authentication ho\u00e0n th\u00e0nh. \u0110i\u1ec1u n\u00e0y c\u00f3 ngh\u0129a l\u00e0 sau khi x\u00e1c \u0111\u1ecbnh \u0111\u01b0\u1ee3c danh t\u00ednh ng\u01b0\u1eddi d\u00f9ng (authentication), h\u1ec7 th\u1ed1ng s\u1ebd ti\u1ebfp t\u1ee5c ki\u1ec3m tra xem ng\u01b0\u1eddi d\u00f9ng c\u00f3 th\u1ec3 l\u00e0m g\u00ec tr\u00ean t\u00e0i nguy\u00ean (url, t\u1eadp tin, ch\u1ee9c n\u0103ng\u2026) c\u1ee7a h\u1ec7 th\u1ed1ng hay c\u00f2n g\u1ecdi l\u00e0 ph\u00e2n quy\u1ec1n tr\u00ean h\u1ec7 th\u1ed1ng.<\/p>\n V\u00ed d\u1ee5,\u00a0 m\u1ed9t user ch\u1ec9 c\u00f3 quy\u1ec1n xem b\u00e0i vi\u1ebft m\u00e0 kh\u00f4ng c\u00f3 quy\u1ec1n ch\u1ec9nh s\u1eeda, \u0111\u00f3 l\u00e0 authorization.<\/p>\n C\u00e1c h\u00ecnh th\u1ee9c ph\u00e2n quy\u1ec1n th\u01b0\u1eddng g\u1eb7p l\u00e0:<\/p>\n + Role-based authorization: Ph\u00e2n quy\u1ec1n d\u1ef1a tr\u00ean vai tr\u00f2 c\u1ee7a ng\u01b0\u1eddi d\u00f9ng. V\u00ed d\u1ee5 trong WordPress c\u00f3 c\u00e1c role nh\u01b0 l\u00e0 \u00a0Subscriber, Contributor, Author, Editor, Administrator v\u00e0 m\u1ed7i m\u1ed9t role s\u1ebd c\u00f3 nh\u1eefng quy\u1ec1n kh\u00e1c nhau v\u00e0 m\u1ed7i ng\u01b0\u1eddi d\u00f9ng s\u1ebd \u0111\u01b0\u1ee3c ph\u00e2n role c\u00f3 quy\u1ec1n t\u01b0\u01a1ng \u1ee9ng. \u0110\u1ed1i v\u1edbi nh\u1eefng h\u1ec7 th\u1ed1ng c\u00f3 nhi\u1ec1u ng\u01b0\u1eddi d\u00f9ng th\u00ec role-based l\u00e0 c\u00e1ch ti\u1ebfp c\u1eadn t\u1ed1t nh\u1ea5t \u0111\u1ec3 ti\u1ebft ki\u1ec7m th\u1eddi gian trong vi\u1ec7c ph\u00e2n quy\u1ec1n.<\/p>\n + Object-based authorization: Ph\u00e2n quy\u1ec1n theo \u0111\u1ed1i t\u01b0\u1ee3ng. C\u00e1ch n\u00e0y s\u1ebd ph\u00e2n quy\u1ec1n cho t\u1eebng \u0111\u1ed1i t\u01b0\u1ee3ng c\u1ee5 th\u1ec3. V\u00ed d\u1ee5 nh\u1eefng \u0111\u1ed1i t\u01b0\u1ee3ng trong nh\u00f3m A, B \u0111\u01b0\u1ee3c ph\u00e2n quy\u1ec1n ch\u1ec9nh s\u1eeda c\u00e1c b\u00e0i vi\u1ebft trong danh m\u1ee5c. Nh\u01b0ng \u0111\u1ed1i t\u01b0\u1ee3ng trong nh\u00f3m A ch\u1ec9 ch\u1ec9nh s\u1eeda \u0111\u01b0\u1ee3c b\u00e0i vi\u1ebft trong danh m\u1ee5c C, \u0111\u1ed1i tr\u01b0\u1ee3ng trong nh\u00f3m B ch\u1ec9 ch\u1ec9nh s\u1eeda b\u00e0i vi\u1ebft trong danh m\u1ee5c D.<\/p>\n Ngu\u1ed3n tham kh\u1ea3o th\u00eam:<\/p>\n http:\/\/searchsecurity.techtarget.com\/definition\/authentication<\/a><\/p>\n http:\/\/searchsoftwarequality.techtarget.com\/definition\/authorization<\/a><\/p>\n