Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authorization]

The tag has no usage guidance.

3
votes
1answer
122 views

Where to put domain knowledge for Authorization?

I hope this is the correct SE site for this kind of question. My team is currently developing an application which IMO needs access control beyond RBAC. Users can have access rights to entities based ...
0
votes
1answer
35 views

Authorization & Profiles considerations for ASP.NET MVC Customer Portal

there's an up and running self-serve customer portal built that I'm trying to make a bit better when it comes to displaying proper items for different client types and auto-logging users. Here are a ...
0
votes
0answers
34 views

User Managed Access on authorization servers: appropriate fine-grained authorization policy use-case?

We need to set up a third party authorization system for exchanges between a server, owning a resource, and a "requesting party" client, needing action on this resource (reading, modifying). The User-...
0
votes
0answers
40 views

Asynchronous Micro-Service Authorization

I have the following setup for my application: A User logs in and is granted a Session Token. When making API requests to Service A the User provides the Session Token. All requests go through an API ...
1
vote
0answers
100 views

How to support anonymous user in web application?

I work for a publishing company that also provides content distribution to their users. In order to access a piece of content the user must be entitled to do so. Traditionally this authorization check ...
1
vote
0answers
24 views

OAuth2 - client_credentials

I am in the process of building out a private REST API. This API is intended for machine to machine communication. In short someone else's server will kick off a job via CRON that pulls information ...
4
votes
3answers
406 views

Authorization and Audit on models in MVC architecture

What are the best practices to extend Authorization to the Model layer if in a monolith MVC application (i.e rails) you have other entry-points than just the Controller? I.e background jobs, or the ...
1
vote
0answers
41 views

Viable ways to handle an access token on the resource/web application server

Use case: We have a product which ties a set of resources to a concrete user. Now we would like to provide the customers with an API so that an automated client application can have access to a ...
1
vote
0answers
240 views

Authorization, permissions, and scoping resources in a microservice/DDD architecture

I'm building a microservice-based application (services according to DDD) and am about to implement authorization service. There are API gateways and UI applications that access backend servers, and ...
1
vote
1answer
43 views

Multiple app authentication, universal user login, best practice

Please see the below diagram. There are two apps that each have a different set of functions, User A is a user of App1 and User B is a user of App2. They should not be able to log in directly to the ...
0
votes
0answers
154 views

How to handle role based access in my microservice architecture

We are trying to move from a monolith application to a microservice architecture faced by a spa application. One of the reason, is that we want to expose some services of our business to partners and ...
1
vote
1answer
62 views

Help with definition of broad user types

I am trying to define the boundary between two broad types of users. The first are those who make use of corporate systems (accounting, ERP, CRM, etc.) and this also includes B2B users, for example ...
1
vote
3answers
675 views

Should it be a claim, a role or a policy?

The distinction between roles and claims is that roles describe a set of users and claims describe a property of a user. So there can be a role "Administrator", but there can also be a claim "...
3
votes
2answers
118 views

How to safeguard a COTS REST API with on-premise servers for approved client apps only?

Goal: Prevent unauthorized 'clone' apps from using REST API-based solutions where the customers manage their own servers and services instead of the vendor doing so (database, resource, and identity). ...
1
vote
1answer
44 views

What is the best way to implement model property authorization in an ASP MVC?

We have an MVC application that has very granular and configurable authorization. We currently have been using the authorize attribute against our controllers and controller functions. The next ...
-2
votes
1answer
107 views

How to migrate an existing ASP.NET MVC site to ASP.NET MVC Core - specifically on authorization

I am in the process of upgrading an existing website to ASP.NET Core 2.1. The goal is simplification and ease of maintenance. Existing site is using: EF and .NET 4.6.2 A [Users] table in SQL Server ...
2
votes
1answer
77 views

Architecture - Whether/Where to store 3rd party IDs

I've got an application where users can log in with varying levels of permissions. From their client they send a username & password to the front end, which passes it to the back end, and from ...
0
votes
2answers
72 views

RESTful API authorization for updatable fields

I've got a resource as follows where state is a enum: { id: 123, industry: { id: 245, name: "Farming" }, "scheduleDate": "2018-01-01", "state": "Requested|Approved|Standardized|...
-1
votes
1answer
26 views

How to implement linkedin authentication/data sharing with multi party?

Hi I am working on application 2. My application interacts with application 1 and 3. Clients of application 1 need to be to share their linkedin profile information with application 3. I have ...
3
votes
1answer
2k views

Dealing with permissions for the list of resource

I have a few big services, that uses the same database and tables for managing roles and permissions. Each service ask the database directly for the permissions. Now I need to build a new service. ...
1
vote
1answer
176 views

Authorization and Domain Model

I have an enterprise system that is represented by a domain model, part of the requirement that the system should limit access to some of the features based on privileges of the logged in user. ...
-1
votes
1answer
190 views

How to delegate the refresh token renewal in a SOA

So, we've got SOA on the backend (BE) and on the frontend (FE) we've got micro-frontends (the separate micro-frontends are loaded as components into the frontend app when needed, so internal process ...
3
votes
1answer
595 views

Designing authentication and authorisation micro service

Background: There are three different applications A, B and C and they all share same user details but I had to implement authentication in each of them which was duplication of effort. After some ...
6
votes
4answers
1k views

Best way to do Client side authorization for a single page JavaScript application?

I already have a solid back-end permissions authorization (ie. admin can perform an action, a normal user cannot perform an action). However, I'm wondering if there is a better way to do a frontend ...
3
votes
1answer
773 views

REST API Design: Multiple resources and authorization

I'm working on a service that forwards/unifies our API calls to external platforms/services. For example, let's say that I don't want to handle all possible actions (create post, retrieve post, edit ...
9
votes
2answers
4k views

Implementing DDD: users and permissions

I am working on a small application trying to grasp the principles of domain-driven design. If successful, this might be a pilot for a larger project. I'm trying to follow the book "Implementing ...
0
votes
1answer
288 views

Anonymous Controller/Action within Authorized Site

Say I have an MVC .net core website where 100% of the controllers/methods are behind [Authorize] attributes (complete with policies and all). Would it be taboo, to carve out a set of un-authorized/...
1
vote
2answers
120 views

Is there a valid alternative to HTTP headers for sending auth credentials

I have built simple auth for REST servers in academic projects. I always used the headers to pass the credentials. This is probably just because every tutorial I've ever seen did it this way. ...
-1
votes
1answer
72 views

Does Policy-Based authentication remove refactoring security?

I understand Role Based Security. I have read about Policy Based. I have read what others call Activity Based. What I want to know is if I do Policy-Based, am I avoiding what Role-Based requires and ...
2
votes
4answers
413 views

Synonym for “Authorization”?

I think a lot of new comers get confused because these two terms look and sound similar: Authentication Authorization I think "Authentication" is well known, I will use this term. But for some docs ...
0
votes
2answers
902 views

How to secure web services when authentication is done at client side (frontend)

I have web application which structure is as- webapi : django web services [NOT REST] no security implemented frontend : Angular2. authentication implemented via SAML Database : Mongodb Can you ...
4
votes
1answer
3k views

Is it bad practice to store a user's email in a JWT?

I'm using JWTs for user auth in a web application. I have a user db where each user's unique ID is their email. To identify the subject of the JWT, I currently have a claim which stores the user's ...
8
votes
1answer
7k views

Difference between 'aud' and 'iss' in jwt

I want to implement a more robust authentication service and jwt is a big part of what I want to do, and I understand how to write the code, but I'm having a little trouble understanding the ...
8
votes
2answers
10k views

cookie vs. session vs jwt

I am reading up on authentication/authorization in web applications. Could anybody confirm/correct my current knowledge? Cookies: in their early version, a text file with a unique client Id an all ...
1
vote
1answer
3k views

Microservices session data when communicating internally

I'm not sure the title is correct, so please advise if you think of a better title. The scenario is: We have an API gateway that exposes REST API to our clients (web and mobile apps). We have a "...
0
votes
1answer
226 views

Remote authorization on each REST resource request

We have a microservices architecture. One of the components is an Authentication & Authorization Service, which implements OAuth2 standard using encrypted JWTs. On each authentication of a user to ...
7
votes
1answer
423 views

Should I split my API by user type?

Let's say I have an app to manage sporting teams. Potential users have a role of 'coach', 'player', and 'fan'. In many cases they will have to make similar api calls to retrieve info like this: /api/...
0
votes
1answer
1k views

How to make sure I always have an API token?

I am writing an API, in that API I sometimes need to make a call to another, remote API. This remote API needs an authorization token, which it gives if you call an appropriate method (for example, /...
13
votes
1answer
19k views

Where to place an API key: a custom HTTP header VS the Authorization header with a custom scheme

I'm designing a REST API using authorization/authentication via an API Key. I tried to figure out what is the best place for it and found out that many people suggest using a custom HTTP header such ...
2
votes
3answers
741 views

OAuth2 overkill for small business

I'm currently in the process of writing an API that will interact with a web application, iPhone app, and Android app for my work. The API is pretty simple and deals with pilots and their ...
0
votes
1answer
378 views

Which OpenID flow should I choose?

I have simple REST API, based on Asp.Net Core technology. Now, I want to add OpenID for this API. API would be used from mobile applications, single page applications and possibly other API services ...
4
votes
2answers
597 views

Where should authorization live in an application using API gateway/lambda and openid?

For an application which: Will use Google OpenID for account creation & authorization I plan on allowing any user to "create an account" which is why I want to use Google for this AWS API ...
1
vote
2answers
2k views

Authorization and Authentication design for splitting a site into REST API and Web App (AspNetCore MVC)

I am considering splitting a project from monolithic to server side REST API plus isolated web-based front end (or, also, any other third party consumer) that can be hosted on a distinct server and ...
3
votes
1answer
671 views

Authorization server implementation - CRUD vs CQRS

I want to make simple authorization & authentification server (with proper audit logging). I used to see on my job or in many examples classic CRUD approach for this purposes. But now I'm ...
4
votes
2answers
433 views

Authorization checks without littering them in code

My team is currently trying to design an authorization system that can be used in any language (Think authorization as a service). One thing i'm trying to figure out is if there is a good way to write ...
-1
votes
2answers
114 views

Should I prepopulate resources and permissions in my system?

I am following the rbac model in my system. I want to know if I should prepopulate the resources and permissions table? I have resources like contracts, contract_drafts, SLA (service level agreement)...
11
votes
2answers
18k views

How to design role based access control?

I am trying to follow the role bases access control model to restrict what users can or cannot do in my system. So far I have the following entities: users - People who will use the system. Here I ...
0
votes
2answers
553 views

Micro services REST with Javascript user authentication/authorization

I am fairly new to the microservice architecture. I am trying to build a web application in this kind of way. After some research online about microservices and having experience with Spring and ...
2
votes
1answer
431 views

Can a third party service rely on JWT for authorization

I am using JWT for authentication in a micro service architecture. There is 1 UI web app and multiple REST API exposed services in the backend. I am considering a IAM service which will give a JWT to ...
2
votes
3answers
821 views

Rest API and resource authorization

The way I created my rest api is the following: /api/users/{id} /api/users/{id}/items/{itemId} But I also have URIs like this one: /api/items/{itemId} It's a bit confusing to me how to handle the ...