Explain the difference between authentication and authorization processes when using JWT.

Authentication and authorization are two different stages when working with JWT (JSON Web Token):

• Authentication is the process of verifying the user's identity. Usually, the user enters a login and password, the server verifies them, and if the data is correct, it generates a JWT. This token confirms that the user has successfully logged in.

• Authorization is the process of determining the user's access rights. After receiving the JWT, the client sends it with requests, the server verifies the token, and based on the information in it (such as roles or permissions), decides whether to allow or deny certain actions.

Example:

1. User enters login/password → server authenticates and issues a JWT.
2. Client sends a request with the JWT → server verifies the token and authorizes access to resources.

Thus, authentication answers the question "Who are you?", and authorization — "What are you allowed to do?".