The authorization tag has no usage guidance.
0
votes
2answers
52 views
RESTful API authorization for updatable fields
I've got a resource as follows where state is a enum:
{
id: 123,
industry: {
id: 245,
name: "Farming"
},
"scheduleDate": "2018-01-01",
"state": "Requested|Approved|Standardized|...
0
votes
0answers
16 views
ASP.NET RoleProvider AddUsersToRoles - Removing exception if user already has role
I'm implementing a custom RoleProvider in my ASP.NET web app, however I had a question about the example implementations of AddUsersToRoles and it's Remove counterpart shown here:
https://msdn....
-1
votes
1answer
21 views
How to implement linkedin authentication/data sharing with multi party?
Hi I am working on application 2.
My application interacts with application 1 and 3.
Clients of application 1 need to be to share their linkedin profile information with application 3.
I have ...
1
vote
1answer
98 views
Dealing with permissions for the list of resource
I have a few big services, that uses the same database and tables for managing roles and permissions. Each service ask the database directly for the permissions.
Now I need to build a new service. ...
0
votes
0answers
37 views
OAuth2 authorization and storing users to custom storage
My question is relating to securing API with Google OAuth2 authorization and multiple clients.
But I also want to store users to my own storage so I can have additional info about them. So when the ...
1
vote
1answer
50 views
Authorization and Domain Model
I have an enterprise system that is represented by a domain model, part of the requirement that the system should limit access to some of the features based on privileges of the logged in user.
...
-1
votes
1answer
59 views
How to delegate the refresh token renewal in a SOA
So, we've got SOA on the backend (BE) and on the frontend (FE) we've got micro-frontends (the separate micro-frontends are loaded as components into the frontend app when needed, so internal process ...
2
votes
1answer
160 views
Designing authentication and authorisation micro service
Background:
There are three different applications A, B and C and they all share same user details but I had to implement authentication in each of them which was duplication of effort.
After some ...
6
votes
4answers
418 views
Best way to do Client side authorization for a single page JavaScript application?
I already have a solid back-end permissions authorization (ie. admin can perform an action, a normal user cannot perform an action).
However, I'm wondering if there is a better way to do a frontend ...
3
votes
1answer
388 views
REST API Design: Multiple resources and authorization
I'm working on a service that forwards/unifies our API calls to external platforms/services.
For example, let's say that I don't want to handle all possible actions (create post, retrieve post, edit ...
0
votes
0answers
221 views
Scalable architecture for multi-tenant auth solution
We're evaluating two different architectures for setting up KeyCloak to allow users to grant access to other users and third parties to tenants within our system.
I'm looking for experienced feedback ...
5
votes
2answers
1k views
Implementing DDD: users and permissions
I am working on a small application trying to grasp the principles of domain-driven design. If successful, this might be a pilot for a larger project. I'm trying to follow the book "Implementing ...
0
votes
1answer
85 views
Anonymous Controller/Action within Authorized Site
Say I have an MVC .net core website where 100% of the controllers/methods are behind [Authorize] attributes (complete with policies and all).
Would it be taboo, to carve out a set of un-authorized/...
0
votes
2answers
86 views
Is there a valid alternative to HTTP headers for sending auth credentials
I have built simple auth for REST servers in academic projects. I always used the headers to pass the credentials. This is probably just because every tutorial I've ever seen did it this way. ...
-1
votes
1answer
63 views
Does Policy-Based authentication remove refactoring security?
I understand Role Based Security.
I have read about Policy Based.
I have read what others call Activity Based.
What I want to know is if I do Policy-Based, am I avoiding what Role-Based requires and ...
1
vote
2answers
232 views
Synonym for “Authorization”?
I think a lot of new comers get confused because these two terms look and sound similar:
Authentication
Authorization
I think "Authentication" is well known, I will use this term.
But for some docs ...
0
votes
2answers
560 views
How to secure web services when authentication is done at client side (frontend)
I have web application which structure is as-
webapi : django web services [NOT REST] no security implemented
frontend : Angular2. authentication implemented via SAML
Database : Mongodb
Can you ...
1
vote
0answers
262 views
Proper handling of JWTs within a Spring Cloud distributed system
I hope this question isn't a bit low level, however I'm seeking clarification around what I've implemented in terms of design and best practises.
Using Spring Cloud, along with Zuul I have a ...
3
votes
1answer
1k views
Is it bad practice to store a user's email in a JWT?
I'm using JWTs for user auth in a web application. I have a user db where each user's unique ID is their email. To identify the subject of the JWT, I currently have a claim which stores the user's ...
0
votes
1answer
2k views
Difference between 'aud' and 'iss' in jwt
I want to implement a more robust authentication service and jwt is a big part of what I want to do, and I understand how to write the code, but I'm having a little trouble understanding the ...
7
votes
2answers
6k views
cookie vs. session vs jwt
I am reading up on authentication/authorization in web applications. Could anybody confirm/correct my current knowledge?
Cookies: in their early version, a text file with a unique client Id an all ...
0
votes
1answer
1k views
Microservices session data when communicating internally
I'm not sure the title is correct, so please advise if you think of a better title.
The scenario is:
We have an API gateway that exposes REST API to our clients (web and
mobile apps).
We have a "...
0
votes
1answer
213 views
Remote authorization on each REST resource request
We have a microservices architecture. One of the components is an Authentication & Authorization Service, which implements OAuth2 standard using encrypted JWTs. On each authentication of a user to ...
7
votes
1answer
382 views
Should I split my API by user type?
Let's say I have an app to manage sporting teams. Potential users have a role of 'coach', 'player', and 'fan'. In many cases they will have to make similar api calls to retrieve info like this:
/api/...
0
votes
1answer
373 views
How to make sure I always have an API token?
I am writing an API, in that API I sometimes need to make a call to another, remote API. This remote API needs an authorization token, which it gives if you call an appropriate method (for example, /...
5
votes
1answer
9k views
Where to place an API key: a custom HTTP header VS the Authorization header with a custom scheme
I'm designing a REST API using authorization/authentication via an API Key.
I tried to figure out what is the best place for it and found out that many people suggest using a custom HTTP header such ...
3
votes
3answers
536 views
OAuth2 overkill for small business
I'm currently in the process of writing an API that will interact with a web application, iPhone app, and Android app for my work. The API is pretty simple and deals with pilots and their ...
1
vote
1answer
304 views
Which OpenID flow should I choose?
I have simple REST API, based on Asp.Net Core technology.
Now, I want to add OpenID for this API.
API would be used from mobile applications, single page applications and possibly other API services ...
4
votes
2answers
450 views
Where should authorization live in an application using API gateway/lambda and openid?
For an application which:
Will use Google OpenID for account creation & authorization
I plan on allowing any user to "create an account" which is why I want to use Google for this
AWS API ...
1
vote
2answers
2k views
Authorization and Authentication design for splitting a site into REST API and Web App (AspNetCore MVC)
I am considering splitting a project from monolithic to server side REST API plus isolated web-based front end (or, also, any other third party consumer) that can be hosted on a distinct server and ...
4
votes
1answer
440 views
Authorization server implementation - CRUD vs CQRS
I want to make simple authorization & authentification server (with proper audit logging).
I used to see on my job or in many examples classic CRUD approach for this purposes.
But now I'm ...
3
votes
2answers
324 views
Authorization checks without littering them in code
My team is currently trying to design an authorization system that can be used in any language (Think authorization as a service). One thing i'm trying to figure out is if there is a good way to write ...
-1
votes
2answers
89 views
Should I prepopulate resources and permissions in my system?
I am following the rbac model in my system.
I want to know if I should prepopulate the resources and permissions table?
I have resources like contracts, contract_drafts, SLA (service level agreement)...
5
votes
2answers
7k views
How to design role based access control?
I am trying to follow the role bases access control model to restrict what users can or cannot do in my system.
So far I have the following entities:
users - People who will use the system. Here I ...
0
votes
2answers
482 views
Micro services REST with Javascript user authentication/authorization
I am fairly new to the microservice architecture. I am trying to build a web application in this kind of way. After some research online about microservices and having experience with Spring and ...
2
votes
1answer
277 views
Can a third party service rely on JWT for authorization
I am using JWT for authentication in a micro service architecture. There is 1 UI web app and multiple REST API exposed services in the backend. I am considering a IAM service which will give a JWT to ...
1
vote
3answers
626 views
Rest API and resource authorization
The way I created my rest api is the following:
/api/users/{id}
/api/users/{id}/items/{itemId}
But I also have URIs like this one:
/api/items/{itemId}
It's a bit confusing to me how to handle the ...
17
votes
1answer
3k views
SOA/Microservices: How to handle authorization in inter-services communications?
Foreground
We are moving from a monolithic platform to a more Service Oriented Architecture. We are applying very basic DDD principles and splitting our domain across different bounded contexts. Each ...
4
votes
2answers
579 views
REST API Oauth 2 - Which grant type to use?
I have an application which basically inserts some rows from the current front end web application.
All the calls before the service layer checks/validates if the user is allowed to insert data or ...
8
votes
3answers
330 views
Authentication via tokens
I'm relatively new to jwt.io and authentication and I'm using JWT.io in following manner.
Server Side
Once user logs in, I generate a token with userid embedded inside and pass it back to the user ...
-1
votes
1answer
794 views
How to manage authentication for internal and external API? [closed]
What I mean by Internal and External API's:
Internal API: will be used by my front-end Apps (Web or Mobile).
External API: will be exposed to developers in order to integrate with my API from their ...
2
votes
3answers
705 views
Complicated Authorization Based on dynamic criteria
I am sorry for not posting any code. I am stuck at the design phase -that's why-
What I want to accomplish is: allowing system administrators of a 'Staff Task System' to dynamically set rights to a ...
3
votes
1answer
219 views
What is the purpose of a multi-claims-based authorization system?
I'm having a difficult time conceptualizing the purpose of a multi-claims-based authorization system. For example, ASP.NET MVC Identity allows for key-value pairs called claims that you can store on a ...
0
votes
1answer
441 views
Is it possible to secure both web page and web API access with a JWT?
I am trying to wrap my head around having a secure WEB API and at the same time securing the client that accesses the WEB API. I am hoping someone can point me in the right direction.
Here is my ...
3
votes
2answers
216 views
Proper way to differentiate user types in OO
I'm designing an application where I have users and admins (further down in the future, I can have different sub-ranks, where each one can have access to some area of the application).
Currently, I ...
2
votes
3answers
7k views
Database design for a role based access system?
I'm considering different designs for a generic role library gem.
The first is based off the Rolify gem but with a has_many through: relationship instead of HABTM. HABTM tables are "headless" in ...
1
vote
2answers
112 views
Undefined changes in data workflow, roles and permission/authorization (on-the-fly changes)
I am having trouble with code design for current scenario of process workflow. For example, by default it is set in the app that for some request 'A' direct manager has the authority to 'approve' that ...
0
votes
1answer
244 views
Appropriate HTTP status code when authorization server is unavailable
We have authorization server which is in charge of checking token validity, expiration etc. Which HTTP status code should be returned if the authorization server is down?
Should it be 401 with "...
0
votes
1answer
163 views
Handle Web application authentication tokens
I am new to the token concept of Authorization.
I am developing angular app which calls the Web API built with asp.net core. I am currently using JWT(JSON web Token) to authorize the users. These ...
14
votes
5answers
5k views
Authorization and authentication system for microservices and consumers
We plan to refactor our company system into a micro-service based system. This micro-services will be used by our own internal company applications and by 3rd party partners if needed. One for booking,...
