I hear a version of this a lot from founders describing their app: "it's secure, you need an account to use it." A login screen is genuinely good, requiring an account is real progress over an open app. It's also answering a much narrower question than most people assume it is.
The two separate questions
Authentication answers: who is this person? A login screen, a password check, a session token, all of that is authentication. Authorization answers a completely different question: now that I know who you are, what are you actually allowed to see and do? A login screen only ever answers the first question. Plenty of apps with a perfectly solid login screen still let a logged-in user reach data or actions that belong to someone else entirely.
What this actually looks like in practice
The most common version: you're logged into your own account, looking at your own invoice at a URL like /invoices/482. Someone changes the number to 483 and, if the app never checks whether invoice 483 actually belongs to them, they're looking at somebody else's invoice. Fully authenticated, fully logged in, and looking at data that was never theirs. The login screen did its job perfectly. The authorization check simply never happened.
Why this gap is so common in fast-built apps
Login is a feature that gets built once, tested once, and largely forgotten because it visibly works: wrong password fails, right password succeeds. Authorization isn't one feature, it's a check that has to be repeated correctly on every single piece of data and every single action in the app, one at a time. It's much easier to get the first part right and quietly miss the second in a dozen places.
Being logged in tells the app who you are. It doesn't tell the app what you're allowed to touch.
How to check your own app
- Log in as one test account, note the URL or ID for something that belongs to you specifically: an order, a document, a message.
- Log in as a second, different test account, and try changing the ID in the URL or request to the first account's number.
- If you can see it, that's the gap, confirmed directly, regardless of how solid the login screen itself is.
A login screen is necessary. It was never meant to be sufficient on its own, and treating it as the whole security story is where this particular gap tends to hide.