Questions tagged [authorization]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
63
votes
3answers
31k views

Role vs Permission Based Access Control

I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization). Let's start with a given: in our system, a Permission will be a fine-...
30
votes
1answer
37k views

Where to place an API key: a custom HTTP header VS the Authorization header with a custom scheme

I'm designing a REST API using authorization/authentication via an API Key. I tried to figure out what is the best place for it and found out that many people suggest using a custom HTTP header such ...
26
votes
3answers
17k views

Implementing DDD: users and permissions

I am working on a small application trying to grasp the principles of domain-driven design. If successful, this might be a pilot for a larger project. I'm trying to follow the book "Implementing ...
24
votes
2answers
38k views

How to design role based access control?

I am trying to follow the role bases access control model to restrict what users can or cannot do in my system. So far I have the following entities: users - People who will use the system. Here I ...
21
votes
1answer
5k views

SOA/Microservices: How to handle authorization in inter-services communications?

Foreground We are moving from a monolithic platform to a more Service Oriented Architecture. We are applying very basic DDD principles and splitting our domain across different bounded contexts. Each ...
20
votes
2answers
17k views

Should I store my user claims in the JWT token?

I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure. I cannot makeup my mind as to whether ...
19
votes
3answers
10k views

Is it bad practice to store a user's email address in a JWT?

I'm using JWTs for user auth in a web application. I have a user db where each user's unique ID is their email address. To identify the subject of the JWT, I currently have a claim which stores the ...
17
votes
5answers
9k views

Authorization and authentication system for microservices and consumers

We plan to refactor our company system into a micro-service based system. This micro-services will be used by our own internal company applications and by 3rd party partners if needed. One for booking,...
16
votes
1answer
15k views

Difference between 'aud' and 'iss' in jwt

I want to implement a more robust authentication service and jwt is a big part of what I want to do, and I understand how to write the code, but I'm having a little trouble understanding the ...
13
votes
8answers
1k views

Punishing users for insecure passwords [closed]

I'm thinking about limiting the rights of users who choose insecure passwords (insecurity of a password being determined by length, how many types of characters (upper/lower case, numbers, symbols, ...
13
votes
1answer
2k views

Should I split my API by user type?

Let's say I have an app to manage sporting teams. Potential users have a role of 'coach', 'player', and 'fan'. In many cases they will have to make similar api calls to retrieve info like this: /api/...
12
votes
2answers
12k views

cookie vs. session vs jwt

I am reading up on authentication/authorization in web applications. Could anybody confirm/correct my current knowledge? Cookies: in their early version, a text file with a unique client Id an all ...
12
votes
2answers
7k views

User authorization with microservices

Should microservices be responsible for handling their own authorization or you think it's better to have a separate authorization service that is shared across all or a subset (within the same ...
9
votes
4answers
7k views

Should it be a claim, a role or a policy?

The distinction between roles and claims is that roles describe a set of users and claims describe a property of a user. So there can be a role "Administrator", but there can also be a claim "...
9
votes
2answers
6k views

Auth options for distributed systems

I am in the process of designing 3 components that will work in symphony with one another: A RESTful web service which requires BasicAuth over HTTPS on all calls, and which is what actually does all ...
9
votes
2answers
5k views

Prevent abuse to REST API endpoint

Question 1 I have a login API endpoint http://127.0.0.1:8080/api/account/login It checks if the phone number has been validated. If not it will call POST http://127.0.0.1:8080/api/account/sendsms ...
9
votes
2answers
852 views

Imitating Exchange Server's "RBAC AuthZ" in my own application... (is there something similar?)

Exchange 2010 has a delegation model where groups of winrm cmdlets are essentally grouped into roles, and the roles assigned to a user. (Image source) This is a great & flexible model ...
8
votes
4answers
3k views

Best way to do Client side authorization for a single page JavaScript application?

I already have a solid back-end permissions authorization (ie. admin can perform an action, a normal user cannot perform an action). However, I'm wondering if there is a better way to do a frontend ...
8
votes
3answers
2k views

OAuth alternative for a 2 party system

I'm writing a RESTful service (Java EE, Jersey) and a client application that communicates with it, and I wish to secure it and store any usernames & passwords dedicated in my own database. I do ...
8
votes
4answers
4k views

Correct Way to Implementing Authorization Checks in ASP MVC

In ASP MVC we have the Authorize attribute to perform check at either a controller level or at a controller method level. But what if you need to do check permissions inside a controller method e.g ...
8
votes
3answers
382 views

Authentication via tokens

I'm relatively new to jwt.io and authentication and I'm using JWT.io in following manner. Server Side Once user logs in, I generate a token with userid embedded inside and pass it back to the user ...
8
votes
3answers
2k views

Best solution to authorize that a user is only allowed to modify/act with their own resources in a REST API

Background: Currently in the process of building out a REST API, using node w/express and it is consumed by a mobile app and eventually a (modern browser based) website. I'm trying to identify the ...
7
votes
2answers
4k views

Examples of permission-based authorization systems in .NET? [closed]

I'm trying to figure out how to do roles/permissions in our application, and I am wondering if anyone knows of a good place to get a list of different permission-based authorization systems (...
6
votes
3answers
388 views

Multi platform password storage with retrieval for applications with authorization?

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use. Are ...
6
votes
2answers
952 views

What are the different ways for performing authorization in a web application other than role-based authorization?

The most common approach used for authorization which I know is role based authorization. Instead of directly storing the access rights against the user ids you create roles and store the access ...
5
votes
1answer
5k views

Dealing with permissions for the list of resource

I have a few big services, that uses the same database and tables for managing roles and permissions. Each service ask the database directly for the permissions. Now I need to build a new service. ...
5
votes
2answers
627 views

Authorization checks without littering them in code

My team is currently trying to design an authorization system that can be used in any language (Think authorization as a service). One thing i'm trying to figure out is if there is a good way to write ...
5
votes
2answers
8k views

Authentication and authorization - front-end vs back-end dilemma

I'm working on centralized authentication and authorization API system and got stuck in front-end vs back-end dilemma. Front-end person is telling that should to have only one request to that API to ...
5
votes
1answer
8k views

Token based authentication and multiple sessions

I've a token based authentication system (REST) that I inherited for an iOS app (can't change), and I've to re-use the same authentication web api system (that I can change to adapt for the web ...
4
votes
3answers
303 views

How can I improve this design so that I don't need to dynamically scan classes at runtime?

I'm in the middle of a redesign on the part of my current project that deals with user permissions and authorization. I have an interface named IUserPermissions that encapsulates this information. ...
4
votes
3answers
864 views

Authorization and Audit on models in MVC architecture

What are the best practices to extend Authorization to the Model layer if in a monolith MVC application (i.e rails) you have other entry-points than just the Controller? I.e background jobs, or the ...
4
votes
4answers
15k views

REST Service Authentication/Authorization

I have a WCF rest service that will be consumed by multiple clients. The information returned by the client requires me to know who they are, so that I can return information specific to them. Is ...
4
votes
2answers
420 views

Proper way to differentiate user types in OO

I'm designing an application where I have users and admins (further down in the future, I can have different sub-ranks, where each one can have access to some area of the application). Currently, I ...
4
votes
1answer
631 views

How to solve a general authentication problem for multiple applications?

At my current job (we're in a MS environment), we have multiple deployed web applications, both inter/intra net. The internal apps generally use an Active Diretory sign in, the forward facing sites ...
4
votes
1answer
265 views

How to keep inter-service authorization maintainable?

In our environment (as in many others), it is often the case that one microservice must call another in order to accomplish a task. In our environment, authentication is clear enough - we have a ...
4
votes
1answer
1k views

REST API Design: Multiple resources and authorization

I'm working on a service that forwards/unifies our API calls to external platforms/services. For example, let's say that I don't want to handle all possible actions (create post, retrieve post, edit ...
4
votes
1answer
214 views

How to make sure media are used only on authorized sites?

I have a video library that I need to publish for my clients. The clients need to be able to embed a player into their sites and play the videos. I need to restrict access to my clients only so that ...
4
votes
2answers
686 views

Where should authorization live in an application using API gateway/lambda and openid?

For an application which: Will use Google OpenID for account creation & authorization I plan on allowing any user to "create an account" which is why I want to use Google for this AWS API ...
4
votes
0answers
833 views

Oauth 2 store access token vs verifying on each call

Let's say my Server is both Authorization Server and Resource server My Client (for example mobile app) can authenticate in 2 matters: via Resource Owner Password Credentials Grant via ...
4
votes
0answers
97 views

Adding new service to authenticated website

So I've created an API that I want to leverage to add some functionality to an existing web app. My current website authenticates users using SAML. What I'm looking to do is instead of moving the code ...
3
votes
2answers
3k views

SVN command line client: checkout refused when LDAP password changed “svn: OPTIONS of” (repo) “authorization failed” (but works in TortoiseSVN)

When using the command line/terminal svn client, a colleague is getting "svn: OPTIONS of " [repo] "...authorization failed" error message when they attempt to checkout the repo to be their local ...
3
votes
3answers
23k views

Database design for a role based access system?

I'm considering different designs for a generic role library gem. The first is based off the Rolify gem but with a has_many through: relationship instead of HABTM. HABTM tables are "headless" in ...
3
votes
2answers
2k views

Microservices and authorization

We are currently working on a micro-service based system. The idea behind it is to split our monolithic system to small domains (micro-service per domain). All services will be used by our internal ...
3
votes
1answer
84 views

Should user and service-to-service authentications be separate?

Say I have a system with 5 microservices behind a gateway, and a user signs in through an IDP (OAuth) A user U passes the access token in a request, and the call first reaches the gateway before it ...
3
votes
1answer
80 views

should you have separate application service methods for different roles

Say I have a shipping service where I have both a driver and a dispatcher, but there are multiple roles and a user can belong to more than one role. Both the driver and dispatcher roles can mark a ...
3
votes
3answers
228 views

Auth in microservices applications with service mesh

Premise: - Two services A and B - Resource X has owner U, and is managed by service B Now, I need to handle these auth scenarios: 1- End-user needs to directly use service B's API to access X 2- ...
3
votes
2answers
208 views

How to safeguard a COTS REST API with on-premise servers for approved client apps only?

Goal: Prevent unauthorized 'clone' apps from using REST API-based solutions where the customers manage their own servers and services instead of the vendor doing so (database, resource, and identity). ...
3
votes
1answer
983 views

Authorization server implementation - CRUD vs CQRS

I want to make simple authorization & authentification server (with proper audit logging). I used to see on my job or in many examples classic CRUD approach for this purposes. But now I'm ...
3
votes
2answers
228 views

Where to put domain knowledge for Authorization?

I hope this is the correct SE site for this kind of question. My team is currently developing an application which IMO needs access control beyond RBAC. Users can have access rights to entities based ...
3
votes
2answers
1k views

REST API Oauth 2 - Which grant type to use?

I have an application which basically inserts some rows from the current front end web application. All the calls before the service layer checks/validates if the user is allowed to insert data or ...