Last call to make your voice heard! Our 2022 Developer Survey closes in less than a week. Take survey.

Questions tagged [authorization]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
0 votes
0 answers
46 views

Should authorization be implemented within each service or in a central location?

For example, let's say we are building a service to manage employees for a retail corporation: POST employees GET employees GET employees/{id} PUT employees/{id} DELETE employees/{id} You would want ...
user avatar
  • 109
0 votes
0 answers
28 views

Is it possible or does it make sense to use OAuth 2.0 CodeFlow PKCE for an internal authentication provider?

Suppose that in a solution, there is IdentityServer as authentication provider and there is some APIs which need to be protected using OAuth 2.0 CodeFlow PKCE. I have read in several places that a ...
user avatar
1 vote
2 answers
64 views

How to split out shared authorization logic across spring microservices

Currently working on a project where we have multiple services that all need to consume the same authorization service when their endpoints are hit. Right now we have the authorization boilerplate ...
user avatar
  • 127
0 votes
1 answer
104 views

RBAC - using database vs hard coded

I need to implement RBAC in a project I'm working on, and I'm fairly new to the concept. I am trying to figure out the best way to implement it. The most common approach seems to be to create roles ...
user avatar
0 votes
1 answer
36 views

SwiftUI View permissions best practice?

I am currently developing an iOS application where there are options on the screen to edit and delete a list. Only the user who created this list can edit or delete it. I am struggling to determine ...
user avatar
  • 11
0 votes
1 answer
91 views

BFF/Gateway authorization pattern for other microservices

I'm starting a project using Azure as our serverless framework. The project consists of two separate frontends applications that must talk to some backend services, some will be made by me and others ...
user avatar
  • 103
0 votes
4 answers
124 views

How does one differentiate between a feature flag and an authorization role?

I'm working on moving some of our flags to a 3rd party system but I kinda have a hard time, determining what should be a feature flag and what should remain as authorization permission to a particular ...
user avatar
  • 101
2 votes
1 answer
282 views

What's the difference between policy vs permission based access control?

I am newbie at these stuff and while I was able to distinguish between role-based vs. policy-based authorization models, I can't seem to understand whether there is one between policy-based vs. ...
user avatar
  • 131
1 vote
0 answers
56 views

What is the benefit of performing authn/authz at the API gateway instead of at the service?

I want to know is if we should perform authentication at the API gateway, at the individual service, or both. Let's frame this question and descussion in the context of new development. Specifically, ...
user avatar
  • 229
3 votes
1 answer
149 views

Should user and service-to-service authentications be separate?

Say I have a system with 5 microservices behind a gateway, and a user signs in through an IDP (OAuth) A user U passes the access token in a request, and the call first reaches the gateway before it ...
user avatar
0 votes
0 answers
187 views

Authorization and Cross-Cutting Concerns in DDD (CQRS) - Filtering Data

We are currently in the early phases of developing several applications that differ significantly in their functionality. As part of building these applications, we have also developed a few generic ...
user avatar
  • 49
0 votes
1 answer
187 views

Can I store a refresh token in a queue?

We have a standard microservices setup (Identity Server, API Gateway, services, etc). Some of the services schedule events to be dispatched in the future (future = anything from mins to months ahead) -...
user avatar
  • 133
0 votes
1 answer
127 views

Enriching JWT after OpenID Connect flow

I am struggling to find a good solution for authorization of users after they were properly authenticated through an oidc flow. Let's assume the following setup: An angular SPA is interacting with ...
user avatar
1 vote
0 answers
39 views

Automatic interaction between API and secured 3rd party API

I would like to create GUI + API that calls third party API as follows: third party API is consumed once a day by my API, GUI user doesn’t have to log in every day (eg. can log in only once every 30 ...
user avatar
0 votes
2 answers
198 views

How to implement authorization in a microservices architecture?

I'm looking for a way to avoid centralized management of authorization rules. I'd like every microservice to be responsible for the authorization logic of its actions, but I'm having some trouble ...
user avatar
1 vote
2 answers
145 views

Where to store credentials for a tird-party API in my API?

So my current app process works like this: Client communicates with my API to get certain information My API needs information from a third-party API and uses these to create a response for the ...
user avatar
  • 137
0 votes
2 answers
159 views

How to implement authorization that needs to be done in the same transaction as aggregate method runs in (DDD)?

Generally most of the authorization in the system is done in authorization layer which then calls commands/queries from application layer, which call methods on domain aggregates. However there are ...
user avatar
2 votes
1 answer
811 views

Refresh tokens by example using Angular and Spring Boot

I am designing out an app that would have an Angular frontend and Spring Boot (Java) backend. I was considering (but not married to) the prospect of JWT-based authentication: User logs in with ...
user avatar
0 votes
0 answers
46 views

Design time based job scheduler

Currently, I have a script install_crontab.py -u <user> -c <config> This script takes care of installing cron job that runs as a given user. In my install_crontab script, I check (using ...
user avatar
2 votes
2 answers
122 views

Authenticate users (REST-API)

What I'm trying to build REST-API using Express and SQLite 5 to 10 authors should be able to post articles to /articles except them, no one is allowed to post anything My approach to build it ...
user avatar
  • 129
2 votes
2 answers
233 views

What are the best practices to authorize every REST request?

My question may sound very naïve to someone, but it is what it is. I have below scenario: Relational MySQL Database with BIGINT primary keys and foreign keys Spring boot as a backend (technology ...
user avatar
1 vote
1 answer
58 views

Authentication-as-a-Service (Auth0) and retrieving user profiles for many different users

For my recent project I decided to leverage Authentication-as-a-Service, in particular I am using Auth0 but I do not think this particularly matters. I've got my React client set up correctly and I am ...
user avatar
2 votes
1 answer
252 views

API AuthN/AuthZ and API Gateway

I have implemented authentication on an API Gateway level using NGINX+ and now I have concern if APIs behind it should still to authenticate using API Keys or JWT? What are best practices? My point is ...
user avatar
2 votes
1 answer
101 views

What identity and/or access data are JWT claims intended for?

I am an application developer and am building a token-based auth mechanism for my application. Essentially, the user will log in with username+password, if the credentials are valid, my code will ...
user avatar
0 votes
1 answer
94 views

OWASP Broken Access Control by example: preventing user's from reading/writing data that isn't theirs

I have experience building RBAC-based authorization mechanisms, and understand the theory behind ACLs (DAC?) though I've never had the need to implement them. A situation was just presented to me that ...
user avatar
1 vote
1 answer
144 views

API pagination with external or centralised authorization

I am building a REST API which would power a front end as well as other 3rd party apps and hence I want it to be as "standard" as possible. Right now, I am trying to stick to HATEOAS. The ...
user avatar
1 vote
1 answer
478 views

Token based authentication to multiple API servers

We have a Web server (which also does authentication and authorization) that manages, via an API, one or more servers that contain highly sensitive data. In the below architecture diagram, we manage ...
user avatar
0 votes
1 answer
104 views

How to secure messaging-based communication with microservices

I'm comfortable with a lot of OpenID Connect and OAuth2 concepts in the context of HTTP-based communication between microservices. I'm currently leveraging Azure AD. In the HTTP-based scenario I would ...
user avatar
  • 1
1 vote
1 answer
325 views

Securing API with JWT and elevated access using MFA

At my company we have a central auth server running IdentityServer. There are a number of applications providing some API to client applications. API requests are authenticated with JWT tokens issued ...
user avatar
  • 119
1 vote
1 answer
193 views

API / System Design [Flexible Authentication / Authorization]?

Background: We're a smaller shop that puts out a number of products that require authentication and authorization. We're currently using a 3rd party service to "spin up new auth APIs" for ...
user avatar
1 vote
1 answer
178 views

How to handle authentication & authorization inside microservices

Example Application I will try to explain my problem by using a familiar application. Lets'say I'm building a Discord / Slack / Microsoft Teams clone; and for simplicity’s sake, it will contain 2 ...
user avatar
  • 163
1 vote
1 answer
347 views

HTTP(S) API authentication: why not many services require signing (HMAC)?

I am currently researching existing authentication/authorization solution that are used for REST APIs. More specifically I'm interested in backend-to-backend interactions but client-to-backend is ...
user avatar
0 votes
1 answer
62 views

Mimic a leadership metrics for management users

I have role based access control to my applications. I have team leader application where team leader with valid role can view their teams performance metrics. Now my top management wants to get a ...
user avatar
0 votes
1 answer
83 views

Checking validity of users and tenants in each request

I am designing a centralized IDP to use for a database-per-tenant application that uses a "tid" (Tenant Id) claim in the access token that is used by the WebAPI to create a connection string ...
user avatar
0 votes
3 answers
907 views

Many different user types in a microservice architecture

I'm trying to design a new microservice architecture that will eventually replace our current two monolithic APIs (we develop a desktop payroll software that uses our API to send payroll documents to ...
user avatar
  • 117
1 vote
0 answers
21 views

Defining custom OIDC provider with delegating authentication to another OIDC provider and using own authorization database

I wanted to ask about your ideas on how to solve the problem that I have to solve in my application (App1). This is the classic Fronted + Backend (Angular + Java EE) application to which I am ...
user avatar
  • 111
4 votes
0 answers
577 views

Identity and access management in Clean Architecture and MVC design

The application user has a lot of standard functionality we see in most applications. At a high-level, this includes some form of authentication, authorization, and session management. At a low-level, ...
user avatar
  • 181
-3 votes
1 answer
2k views

Database design user user roles applications and features

We have multiple applications with different features. We want to create a central security system, where each user is assigned a role. Role has access to certain applications and features with in ...
user avatar
2 votes
1 answer
67 views

Proper way to put a fixed hash as Authorization

I am implementing a system for a customer where they are asking me to use a fixed hash to protect the API as authorization. So this fixed value will be sent in the HEADER of the HTTP call as "...
user avatar
2 votes
3 answers
215 views

Securing REST API with authenticated user

I want to build a REST API but I have some holes when it comes to the security part. I would like to get my head around how to authenticate the calls to the API. Therefore, this is my first draft for ...
user avatar
  • 145
2 votes
1 answer
301 views

Delegating authorization across multiple API's

I'm building a multi-tenant system that consists of one (SPA) client, calling multiple API's, all under my control. User authentication is done with OpenID Connect, I'm sending an ID and access token ...
user avatar
3 votes
3 answers
259 views

Auth in microservices applications with service mesh

Premise: - Two services A and B - Resource X has owner U, and is managed by service B Now, I need to handle these auth scenarios: 1- End-user needs to directly use service B's API to access X 2- ...
user avatar
  • 139
1 vote
0 answers
71 views

How to model ACLs?

There are different kinds of ACLs I've generally implemented: Does a user have access to a resourcetype(API)? Does a user have access to a resource(Object)? Does a resource have access to another ...
user avatar
0 votes
2 answers
2k views

Multitenancy with Cross-Tenant Users

We currently have a requirement to build a multi-tenant application that has cross-tenant users. That is the business data is separated by tenant but users can belong to multiple tenants and should ...
user avatar
2 votes
1 answer
84 views

What are some authorization based design patterns to limit functionality from the perspective of size or amount of data?

I am well aware of role based / activity based authorization in the context of limiting user functionality in a simple on/off manner; however, the problem gets difficult when it's not so black and ...
user avatar
  • 175
1 vote
1 answer
147 views

Do authorization checks belong in the controller or the repository/persistor

I have a Laravel project where the controllers (all derived from one of two base controllers) use repository and persistor classes to interface with Eloquent models. Authorization logic is implemented ...
user avatar
  • 155
2 votes
0 answers
32 views

How authorize web application and manage sessions

i am building a single page react app that uses redux as state manager and an express node js as backend server but i don't know what is the best way to authorize my users in the application! if it ...
user avatar
  • 129
3 votes
1 answer
85 views

should you have separate application service methods for different roles

Say I have a shipping service where I have both a driver and a dispatcher, but there are multiple roles and a user can belong to more than one role. Both the driver and dispatcher roles can mark a ...
user avatar
  • 187
8 votes
2 answers
10k views

Authentication and authorization - front-end vs back-end dilemma

I'm working on centralized authentication and authorization API system and got stuck in front-end vs back-end dilemma. Front-end person is telling that should to have only one request to that API to ...
user avatar
2 votes
2 answers
2k views

Dealing with property-level permissions in DDD and should UI or authorization influence the domain model?

Suppose I have a command like below: public sealed class UpdateExampleCommand { public int Field1 { get; set; } public string Field2 { get; set; } public bool Field3 { get; set; } ...
user avatar