authentication
termsecuritygovernance & risk
Establishing who or what is making a request - distinct from deciding what they may do.
The distinction from authorization is the one most incidents turn on: a system that proves identity correctly and then grants everything to anyone who proved it has authenticated perfectly and authorised nothing. Authentication also happens once and is then represented by a token, a cookie or a session, which is why stealing the representation is usually easier than defeating the check - and why lifetime and revocation matter as much as strength.
Also known as: authn