Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [authorization]

The tag has no usage guidance.

41
votes
2answers
19k views

Role vs Permission Based Access Control

I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization). Let's start with a given: in our system, a Permission will be a fine-...
18
votes
1answer
4k views

SOA/Microservices: How to handle authorization in inter-services communications?

Foreground We are moving from a monolithic platform to a more Service Oriented Architecture. We are applying very basic DDD principles and splitting our domain across different bounded contexts. Each ...
16
votes
2answers
13k views

Should I store my user claims in the JWT token?

I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure. I cannot makeup my mind as to whether ...
14
votes
5answers
6k views

Authorization and authentication system for microservices and consumers

We plan to refactor our company system into a micro-service based system. This micro-services will be used by our own internal company applications and by 3rd party partners if needed. One for booking,...
13
votes
8answers
1k views

Punishing users for insecure passwords [closed]

I'm thinking about limiting the rights of users who choose insecure passwords (insecurity of a password being determined by length, how many types of characters (upper/lower case, numbers, symbols, ...
13
votes
1answer
19k views

Where to place an API key: a custom HTTP header VS the Authorization header with a custom scheme

I'm designing a REST API using authorization/authentication via an API Key. I tried to figure out what is the best place for it and found out that many people suggest using a custom HTTP header such ...
11
votes
2answers
18k views

How to design role based access control?

I am trying to follow the role bases access control model to restrict what users can or cannot do in my system. So far I have the following entities: users - People who will use the system. Here I ...
11
votes
2answers
6k views

User authorization with microservices

Should microservices be responsible for handling their own authorization or you think it's better to have a separate authorization service that is shared across all or a subset (within the same ...
9
votes
2answers
4k views

Implementing DDD: users and permissions

I am working on a small application trying to grasp the principles of domain-driven design. If successful, this might be a pilot for a larger project. I'm trying to follow the book "Implementing ...
9
votes
2answers
711 views

Imitating Exchange Server's “RBAC AuthZ” in my own application… (is there something similar?)

Exchange 2010 has a delegation model where groups of winrm cmdlets are essentally grouped into roles, and the roles assigned to a user. (Image source) This is a great & flexible model ...
8
votes
2answers
10k views

cookie vs. session vs jwt

I am reading up on authentication/authorization in web applications. Could anybody confirm/correct my current knowledge? Cookies: in their early version, a text file with a unique client Id an all ...
8
votes
1answer
7k views

Difference between 'aud' and 'iss' in jwt

I want to implement a more robust authentication service and jwt is a big part of what I want to do, and I understand how to write the code, but I'm having a little trouble understanding the ...
8
votes
2answers
4k views

Auth options for distributed systems

I am in the process of designing 3 components that will work in symphony with one another: A RESTful web service which requires BasicAuth over HTTPS on all calls, and which is what actually does all ...
8
votes
3answers
357 views

Authentication via tokens

I'm relatively new to jwt.io and authentication and I'm using JWT.io in following manner. Server Side Once user logs in, I generate a token with userid embedded inside and pass it back to the user ...
8
votes
3answers
1k views

Best solution to authorize that a user is only allowed to modify/act with their own resources in a REST API

Background: Currently in the process of building out a REST API, using node w/express and it is consumed by a mobile app and eventually a (modern browser based) website. I'm trying to identify the ...
7
votes
1answer
423 views

Should I split my API by user type?

Let's say I have an app to manage sporting teams. Potential users have a role of 'coach', 'player', and 'fan'. In many cases they will have to make similar api calls to retrieve info like this: /api/...
7
votes
2answers
3k views

Prevent abuse to REST API endpoint

Question 1 I have a login API endpoint http://127.0.0.1:8080/api/account/login It checks if the phone number has been validated. If not it will call POST http://127.0.0.1:8080/api/account/sendsms ...
7
votes
4answers
2k views

Correct Way to Implementing Authorization Checks in ASP MVC

In ASP MVC we have the Authorize attribute to perform check at either a controller level or at a controller method level. But what if you need to do check permissions inside a controller method e.g ...
7
votes
2answers
4k views

Examples of permission-based authorization systems in .NET? [closed]

I'm trying to figure out how to do roles/permissions in our application, and I am wondering if anyone knows of a good place to get a list of different permission-based authorization systems (...
6
votes
4answers
1k views

Best way to do Client side authorization for a single page JavaScript application?

I already have a solid back-end permissions authorization (ie. admin can perform an action, a normal user cannot perform an action). However, I'm wondering if there is a better way to do a frontend ...
6
votes
3answers
2k views

OAuth alternative for a 2 party system

I'm writing a RESTful service (Java EE, Jersey) and a client application that communicates with it, and I wish to secure it and store any usernames & passwords dedicated in my own database. I do ...
6
votes
3answers
307 views

Multi platform password storage with retrieval for applications with authorization?

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use. Are ...
5
votes
1answer
5k views

Token based authentication and multiple sessions

I've a token based authentication system (REST) that I inherited for an iOS app (can't change), and I've to re-use the same authentication web api system (that I can change to adapt for the web ...
5
votes
2answers
838 views

What are the different ways for performing authorization in a web application other than role-based authorization?

The most common approach used for authorization which I know is role based authorization. Instead of directly storing the access rights against the user ids you create roles and store the access ...
4
votes
3answers
297 views

How can I improve this design so that I don't need to dynamically scan classes at runtime?

I'm in the middle of a redesign on the part of my current project that deals with user permissions and authorization. I have an interface named IUserPermissions that encapsulates this information. ...
4
votes
4answers
15k views

REST Service Authentication/Authorization

I have a WCF rest service that will be consumed by multiple clients. The information returned by the client requires me to know who they are, so that I can return information specific to them. Is ...
4
votes
3answers
406 views

Authorization and Audit on models in MVC architecture

What are the best practices to extend Authorization to the Model layer if in a monolith MVC application (i.e rails) you have other entry-points than just the Controller? I.e background jobs, or the ...
4
votes
1answer
3k views

Is it bad practice to store a user's email in a JWT?

I'm using JWTs for user auth in a web application. I have a user db where each user's unique ID is their email. To identify the subject of the JWT, I currently have a claim which stores the user's ...
4
votes
2answers
433 views

Authorization checks without littering them in code

My team is currently trying to design an authorization system that can be used in any language (Think authorization as a service). One thing i'm trying to figure out is if there is a good way to write ...
4
votes
1answer
615 views

How to solve a general authentication problem for multiple applications?

At my current job (we're in a MS environment), we have multiple deployed web applications, both inter/intra net. The internal apps generally use an Active Diretory sign in, the forward facing sites ...
4
votes
2answers
597 views

Where should authorization live in an application using API gateway/lambda and openid?

For an application which: Will use Google OpenID for account creation & authorization I plan on allowing any user to "create an account" which is why I want to use Google for this AWS API ...
4
votes
0answers
785 views

Oauth 2 store access token vs verifying on each call

Let's say my Server is both Authorization Server and Resource server My Client (for example mobile app) can authenticate in 2 matters: via Resource Owner Password Credentials Grant via ...
4
votes
0answers
181 views

How to make sure media are used only on authorized sites?

I have a video library that I need to publish for my clients. The clients need to be able to embed a player into their sites and play the videos. I need to restrict access to my clients only so that ...
3
votes
2answers
2k views

SVN command line client: checkout refused when LDAP password changed “svn: OPTIONS of” (repo) “authorization failed” (but works in TortoiseSVN)

When using the command line/terminal svn client, a colleague is getting "svn: OPTIONS of " [repo] "...authorization failed" error message when they attempt to checkout the repo to be their local ...
3
votes
1answer
2k views

Dealing with permissions for the list of resource

I have a few big services, that uses the same database and tables for managing roles and permissions. Each service ask the database directly for the permissions. Now I need to build a new service. ...
3
votes
2answers
2k views

Microservices and authorization

We are currently working on a micro-service based system. The idea behind it is to split our monolithic system to small domains (micro-service per domain). All services will be used by our internal ...
3
votes
2answers
118 views

How to safeguard a COTS REST API with on-premise servers for approved client apps only?

Goal: Prevent unauthorized 'clone' apps from using REST API-based solutions where the customers manage their own servers and services instead of the vendor doing so (database, resource, and identity). ...
3
votes
1answer
671 views

Authorization server implementation - CRUD vs CQRS

I want to make simple authorization & authentification server (with proper audit logging). I used to see on my job or in many examples classic CRUD approach for this purposes. But now I'm ...
3
votes
1answer
122 views

Where to put domain knowledge for Authorization?

I hope this is the correct SE site for this kind of question. My team is currently developing an application which IMO needs access control beyond RBAC. Users can have access rights to entities based ...
3
votes
2answers
238 views

Proper way to differentiate user types in OO

I'm designing an application where I have users and admins (further down in the future, I can have different sub-ranks, where each one can have access to some area of the application). Currently, I ...
3
votes
2answers
761 views

REST API Oauth 2 - Which grant type to use?

I have an application which basically inserts some rows from the current front end web application. All the calls before the service layer checks/validates if the user is allowed to insert data or ...
3
votes
1answer
717 views

OAuthv2 for distributed applications

Please note: Months ago I asked this question that received a truly amazing answer and introduction to OAuthv2. I’m now knee deep in the implementation of such a system and have similar (but notably ...
3
votes
2answers
624 views

Using Prolog to implement authorization rules

I'm working on a user management "pseudoframework" in PHP, and I'm trying to implement fine-grained rule-based authorization. I'm using a combination of SQL and condition-checking functions written ...
3
votes
2answers
122 views

How should I specify locations where clients can resolve authorization problems in a REST API?

I'm working through an API design where a user's authentication will be verified by the presence of a valid forms authentication ticket in a session cookie. However, there are additional levels of ...
3
votes
1answer
595 views

Designing authentication and authorisation micro service

Background: There are three different applications A, B and C and they all share same user details but I had to implement authentication in each of them which was duplication of effort. After some ...
3
votes
1answer
773 views

REST API Design: Multiple resources and authorization

I'm working on a service that forwards/unifies our API calls to external platforms/services. For example, let's say that I don't want to handle all possible actions (create post, retrieve post, edit ...
3
votes
0answers
93 views

Adding new service to authenticated website

So I've created an API that I want to leverage to add some functionality to an existing web app. My current website authenticates users using SAML. What I'm looking to do is instead of moving the code ...
2
votes
4answers
413 views

Synonym for “Authorization”?

I think a lot of new comers get confused because these two terms look and sound similar: Authentication Authorization I think "Authentication" is well known, I will use this term. But for some docs ...
2
votes
3answers
741 views

OAuth2 overkill for small business

I'm currently in the process of writing an API that will interact with a web application, iPhone app, and Android app for my work. The API is pretty simple and deals with pilots and their ...
2
votes
3answers
11k views

Database design for a role based access system?

I'm considering different designs for a generic role library gem. The first is based off the Rolify gem but with a has_many through: relationship instead of HABTM. HABTM tables are "headless" in ...