For example, let's say we are building a service to manage employees for a retail corporation:

POST employees
GET employees
GET employees/{id}
PUT employees/{id}
DELETE employees/{id}

You would want basic role-based authorization policies:

  • Employees and store managers can view data
  • Regional managers can view/add/update employees
  • Only corporate HR can delete employees

You would also want resource-level authorization, which might look different for each role:

  • An employee can view his own data
  • A store manager can view employees for her store location
  • A regional manager can view employees for any store in their region
  • A corporate HR person can view all employees in any location

Where is the best place to implement these sorts of authorization policies? In the app itself? In some sort of middleware (API Gateway?)? Does the answer change if we are in a microservices architecture vs. single app?

(I can see trade-offs either way...wondering if there is any general best practice.)


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.