Authentication and authorization services must be decoupled from the business logic services. Otherwise, the server resources of business logic services will be consumed to validate the incoming request sessions. Apart from the decoupling, auth services is getting benefit from layered architecture boilerplate to structure the code to ensure all auth functionality can be fullfilled.

Authentication and Authorization are two distinct concepts but has same purposes which is to give access permits to user. Authorization focus on the credentials verification while authorization focusing on giving access permits based on the assigned role.