Skip to main content

Questions tagged [authorization]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
70 votes
3 answers
35k views

Role vs Permission Based Access Control

I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization). Let's start with a given: in our system, a Permission will be a fine-...
smeeb's user avatar
  • 4,880
38 votes
3 answers
29k views

Implementing DDD: users and permissions

I am working on a small application trying to grasp the principles of domain-driven design. If successful, this might be a pilot for a larger project. I'm trying to follow the book "Implementing ...
LittlePilgrim's user avatar
17 votes
5 answers
10k views

Authorization and authentication system for microservices and consumers

We plan to refactor our company system into a micro-service based system. This micro-services will be used by our own internal company applications and by 3rd party partners if needed. One for booking,...
Robert's user avatar
  • 545
10 votes
2 answers
6k views

Auth options for distributed systems

I am in the process of designing 3 components that will work in symphony with one another: A RESTful web service which requires BasicAuth over HTTPS on all calls, and which is what actually does all ...
smeeb's user avatar
  • 4,880
23 votes
1 answer
6k views

SOA/Microservices: How to handle authorization in inter-services communications?

Foreground We are moving from a monolithic platform to a more Service Oriented Architecture. We are applying very basic DDD principles and splitting our domain across different bounded contexts. Each ...
Josep Serra's user avatar
10 votes
2 answers
6k views

Prevent abuse to REST API endpoint

Question 1 I have a login API endpoint http://127.0.0.1:8080/api/account/login It checks if the phone number has been validated. If not it will call POST http://127.0.0.1:8080/api/account/sendsms ...
momokjaaaaa's user avatar
8 votes
3 answers
2k views

OAuth alternative for a 2 party system

I'm writing a RESTful service (Java EE, Jersey) and a client application that communicates with it, and I wish to secure it and store any usernames & passwords dedicated in my own database. I do ...
Alon Amir's user avatar
  • 183
5 votes
2 answers
784 views

Authorization checks without littering them in code

My team is currently trying to design an authorization system that can be used in any language (Think authorization as a service). One thing i'm trying to figure out is if there is a good way to write ...
Catfish's user avatar
  • 153
4 votes
1 answer
2k views

REST API Design: Multiple resources and authorization

I'm working on a service that forwards/unifies our API calls to external platforms/services. For example, let's say that I don't want to handle all possible actions (create post, retrieve post, edit ...
Slav's user avatar
  • 143
2 votes
1 answer
430 views

API AuthN/AuthZ and API Gateway

I have implemented authentication on an API Gateway level using NGINX+ and now I have concern if APIs behind it should still to authenticate using API Keys or JWT? What are best practices? My point is ...
JackTheKnife's user avatar
1 vote
1 answer
466 views

API pagination with external or centralised authorization

I am building a REST API which would power a front end as well as other 3rd party apps and hence I want it to be as "standard" as possible. Right now, I am trying to stick to HATEOAS. The ...
Sayak Mukhopadhyay's user avatar