Questions tagged [authorization]
The authorization tag has no usage guidance.
147
questions
2
votes
2answers
155 views
What are the best practices to authorize every REST request?
My question may sound very naïve to someone, but it is what it is.
I have below scenario:
Relational MySQL Database with BIGINT primary keys and foreign keys
Spring boot as a backend (technology ...
1
vote
1answer
48 views
Authentication-as-a-Service (Auth0) and retrieving user profiles for many different users
For my recent project I decided to leverage Authentication-as-a-Service, in particular I am using Auth0 but I do not think this particularly matters. I've got my React client set up correctly and I am ...
0
votes
1answer
43 views
API AuthN/AuthZ and API Gateway
I have implemented authentication on an API Gateway level using NGINX+ and now I have concern if APIs behind it should still to authenticate using API Keys or JWT? What are best practices?
My point is ...
1
vote
1answer
78 views
What identity and/or access data are JWT claims intended for?
I am an application developer and am building a token-based auth mechanism for my application. Essentially, the user will log in with username+password, if the credentials are valid, my code will ...
0
votes
1answer
58 views
OWASP Broken Access Control by example: preventing user's from reading/writing data that isn't theirs
I have experience building RBAC-based authorization mechanisms, and understand the theory behind ACLs (DAC?) though I've never had the need to implement them.
A situation was just presented to me that ...
1
vote
1answer
45 views
API pagination with external or centralised authorization
I am building a REST API which would power a front end as well as other 3rd party apps and hence I want it to be as "standard" as possible. Right now, I am trying to stick to HATEOAS. The ...
0
votes
0answers
18 views
How can we apply in the same time role based access to a service used by internal application, external application and others internal services?
I'm trying to figure out how to make sure that our services which are both used by internal and external applications must be secure to only allow calls from clients who are authorized and have the ...
1
vote
1answer
41 views
Token based authentication to multiple API servers
We have a Web server (which also does authentication and authorization) that manages, via an API, one or more servers that contain highly sensitive data. In the below architecture diagram, we manage ...
0
votes
1answer
34 views
How to secure messaging-based communication with microservices
I'm comfortable with a lot of OpenID Connect and OAuth2 concepts in the context of HTTP-based communication between microservices. I'm currently leveraging Azure AD.
In the HTTP-based scenario I would ...
1
vote
1answer
49 views
Securing API with JWT and elevated access using MFA
At my company we have a central auth server running IdentityServer. There are a number of applications providing some API to client applications. API requests are authenticated with JWT tokens issued ...
0
votes
1answer
60 views
API / System Design [Flexible Authentication / Authorization]?
Background:
We're a smaller shop that puts out a number of products that require
authentication and authorization. We're currently using a 3rd party
service to "spin up new auth APIs" for ...
0
votes
1answer
83 views
How to handle authentication & authorization inside microservices
Example Application
I will try to explain my problem by using a familiar application.
Lets'say I'm building a Discord / Slack / Microsoft Teams clone; and for simplicity’s sake, it will contain 2 ...
1
vote
1answer
94 views
HTTP(S) API authentication: why not many services require signing (HMAC)?
I am currently researching existing authentication/authorization solution that are used for REST APIs. More specifically I'm interested in backend-to-backend interactions but client-to-backend is ...
0
votes
1answer
61 views
Mimic a leadership metrics for management users
I have role based access control to my applications. I have team leader application where team leader with valid role can view their teams performance metrics. Now my top management wants to get a ...
0
votes
1answer
69 views
Checking validity of users and tenants in each request
I am designing a centralized IDP to use for a database-per-tenant application that uses a "tid" (Tenant Id) claim in the access token that is used by the WebAPI to create a connection string ...
0
votes
3answers
277 views
Many different user types in a microservice architecture
I'm trying to design a new microservice architecture that will eventually replace our current two monolithic APIs (we develop a desktop payroll software that uses our API to send payroll documents to ...
1
vote
0answers
17 views
Defining custom OIDC provider with delegating authentication to another OIDC provider and using own authorization database
I wanted to ask about your ideas on how to solve the problem that I have to solve in my application (App1). This is the classic Fronted + Backend (Angular + Java EE) application to which I am ...
2
votes
0answers
144 views
Identity and access management in Clean Architecture and MVC design
The application user has a lot of standard functionality we see in most applications. At a high-level, this includes some form of authentication, authorization, and session management. At a low-level, ...
-3
votes
1answer
233 views
Database design user user roles applications and features
We have multiple applications with different features. We want to create a central security system, where each user is assigned a role. Role has access to certain applications and features with in ...
2
votes
1answer
63 views
Proper way to put a fixed hash as Authorization
I am implementing a system for a customer where they are asking me to use a fixed hash to protect the API as authorization. So this fixed value will be sent in the HEADER of the HTTP call as "...
0
votes
0answers
22 views
Standards for access tokens (authorization)
I am looking for standards to implement access tokens to do authorization in our services.
So far I found the OAuth standard, which seems to offer everything we need.
I am however looking for ...
2
votes
3answers
182 views
Securing REST API with authenticated user
I want to build a REST API but I have some holes when it comes to the security part. I would like to get my head around how to authenticate the calls to the API.
Therefore, this is my first draft for ...
2
votes
1answer
91 views
Delegating authorization across multiple API's
I'm building a multi-tenant system that consists of one (SPA) client, calling multiple API's, all under my control.
User authentication is done with OpenID Connect, I'm sending an ID and access token ...
3
votes
3answers
154 views
Auth in microservices applications with service mesh
Premise:
- Two services A and B
- Resource X has owner U, and is managed by service B
Now, I need to handle these auth scenarios:
1- End-user needs to directly use service B's API to access X
2- ...
1
vote
0answers
62 views
How to model ACLs?
There are different kinds of ACLs I've generally implemented:
Does a user have access to a resourcetype(API)?
Does a user have access to a resource(Object)?
Does a resource have access to another ...
0
votes
2answers
594 views
Multitenancy with Cross-Tenant Users
We currently have a requirement to build a multi-tenant application that has cross-tenant users. That is the business data is separated by tenant but users can belong to multiple tenants and should ...
2
votes
1answer
71 views
What are some authorization based design patterns to limit functionality from the perspective of size or amount of data?
I am well aware of role based / activity based authorization in the context of limiting user functionality in a simple on/off manner; however, the problem gets difficult when it's not so black and ...
1
vote
1answer
85 views
Do authorization checks belong in the controller or the repository/persistor
I have a Laravel project where the controllers (all derived from one of two base controllers) use repository and persistor classes to interface with Eloquent models. Authorization logic is implemented ...
2
votes
0answers
27 views
How authorize web application and manage sessions
i am building a single page react app that uses redux as state manager and an express node js as backend server but i don't know what is the best way to authorize my users in the application!
if it ...
3
votes
1answer
59 views
should you have separate application service methods for different roles
Say I have a shipping service where I have both a driver and a dispatcher, but there are multiple roles and a user can belong to more than one role. Both the driver and dispatcher roles can mark a ...
4
votes
2answers
5k views
Authentication and authorization - front-end vs back-end dilemma
I'm working on centralized authentication and authorization API system and got stuck in front-end vs back-end dilemma.
Front-end person is telling that should to have only one request to that API to ...
2
votes
2answers
755 views
Dealing with property-level permissions in DDD and should UI or authorization influence the domain model?
Suppose I have a command like below:
public sealed class UpdateExampleCommand
{
public int Field1 { get; set; }
public string Field2 { get; set; }
public bool Field3 { get; set; }
...
3
votes
0answers
52 views
Designing ABAC-style Authorization module with Row-level security
I'm designing the Authorization part of the AAA module of a business software suite.
Requirements:
There are Users and Groups, and you can assign Permissions to any of those.
You can Grant or ...
2
votes
2answers
1k views
How to efficiently pass permissions that control view and access of specific front-end elements from backend to the SPA using JWT
I would like to introduce permissions based access control in my Single Page Application (SPA) front-end which authenticates the user with token based authentication (JWT).
Permission Requirement:
...
4
votes
1answer
191 views
How to keep inter-service authorization maintainable?
In our environment (as in many others), it is often the case that one microservice must call another in order to accomplish a task.
In our environment, authentication is clear enough - we have a ...
0
votes
4answers
834 views
How to handle user permission changes in SPA?
I have a SPA which at the beginning of application startup calls the backend API, sends a JWT and asks for the access permissions of the current user. SPA then caches the permissions in-memory and ...
0
votes
0answers
57 views
Prevent token sharing: chained single-use tokens VS a designated invalidation feature
Situation:
A Client is requesting a resource from a Host multiple times, usually with minutes or hours between requests.
The Client has a signed, verifiable token, which we'll call a Receipt, that ...
0
votes
2answers
167 views
Is creating a leaderboard web API that can't be fudged possible?
Let's say you have a game, and players of your game can get scores. You also want to be able to post these scores to a server using calls to a web API. Obviously, you want to be able to tell who sent ...
3
votes
2answers
196 views
Where to put domain knowledge for Authorization?
I hope this is the correct SE site for this kind of question.
My team is currently developing an application which IMO needs access control beyond RBAC. Users can have access rights to entities based ...
0
votes
1answer
103 views
Authorization & Profiles considerations for ASP.NET MVC Customer Portal
there's an up and running self-serve customer portal built that I'm trying to make a bit better when it comes to displaying proper items for different client types and auto-logging users. Here are a ...
0
votes
0answers
65 views
Asynchronous Micro-Service Authorization
I have the following setup for my application:
A User logs in and is granted a Session Token.
When making API requests to Service A the User provides the Session Token.
All requests go through an API ...
2
votes
0answers
836 views
How to support anonymous user in web application?
I work for a publishing company that also provides content distribution to their users. In order to access a piece of content the user must be entitled to do so. Traditionally this authorization check ...
2
votes
0answers
33 views
OAuth2 - client_credentials
I am in the process of building out a private REST API. This API is intended for machine to machine communication. In short someone else's server will kick off a job via CRON that pulls information ...
4
votes
3answers
695 views
Authorization and Audit on models in MVC architecture
What are the best practices to extend Authorization to the Model layer if in a monolith MVC application (i.e rails) you have other entry-points than just the Controller? I.e background jobs, or the ...
2
votes
0answers
199 views
Viable ways to handle an access token on the resource/web application server
Use case:
We have a product which ties a set of resources to a concrete user.
Now we would like to provide the customers with an API so that an automated client application can have access to a ...
3
votes
0answers
650 views
Authorization, permissions, and scoping resources in a microservice/DDD architecture
I'm building a microservice-based application (services according to DDD) and am about to implement authorization service. There are API gateways and UI applications that access backend servers, and ...
1
vote
1answer
563 views
Multiple app authentication, universal user login, best practice
Please see the below diagram.
There are two apps that each have a different set of functions, User A is a user of App1 and User B is a user of App2. They should not be able to log in directly to the ...
0
votes
0answers
759 views
How to handle role based access in my microservice architecture
We are trying to move from a monolith application to a microservice architecture faced by a spa application. One of the reason, is that we want to expose some services of our business to partners and ...
1
vote
1answer
162 views
Help with definition of broad user types
I am trying to define the boundary between two broad types of users. The first are those who make use of corporate systems (accounting, ERP, CRM, etc.) and this also includes B2B users, for example ...
7
votes
4answers
5k views
Should it be a claim, a role or a policy?
The distinction between roles and claims is that roles describe a set of users and claims describe a property of a user. So there can be a role "Administrator", but there can also be a claim "...
