Questions tagged [authorization]
The authorization tag has no usage guidance.
172
questions
69
votes
3
answers
34k
views
Role vs Permission Based Access Control
I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization).
Let's start with a given: in our system, a Permission will be a fine-...
- 4,800
38
votes
1
answer
41k
views
Where to place an API key: a custom HTTP header VS the Authorization header with a custom scheme
I'm designing a REST API using authorization/authentication via an API Key.
I tried to figure out what is the best place for it and found out that many people suggest using a custom HTTP header such ...
- 491
35
votes
3
answers
24k
views
Implementing DDD: users and permissions
I am working on a small application trying to grasp the principles of domain-driven design. If successful, this might be a pilot for a larger project. I'm trying to follow the book "Implementing ...
- 463
30
votes
2
answers
43k
views
How to design role based access control?
I am trying to follow the role bases access control model to restrict what users can or cannot do in my system.
So far I have the following entities:
users - People who will use the system. Here I ...
- 379
23
votes
1
answer
6k
views
SOA/Microservices: How to handle authorization in inter-services communications?
Foreground
We are moving from a monolithic platform to a more Service Oriented Architecture. We are applying very basic DDD principles and splitting our domain across different bounded contexts. Each ...
- 331
22
votes
3
answers
16k
views
Is it bad practice to store a user's email address in a JWT?
I'm using JWTs for user auth in a web application. I have a user db where each user's unique ID is their email address. To identify the subject of the JWT, I currently have a claim which stores the ...
- 391
21
votes
2
answers
18k
views
Should I store my user claims in the JWT token?
I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure.
I cannot makeup my mind as to whether ...
- 313
20
votes
1
answer
19k
views
Difference between 'aud' and 'iss' in jwt
I want to implement a more robust authentication service and jwt is a big part of what I want to do, and I understand how to write the code, but I'm having a little trouble understanding the ...
- 381
17
votes
5
answers
9k
views
Authorization and authentication system for microservices and consumers
We plan to refactor our company system into a micro-service based system. This micro-services will be used by our own internal company applications and by 3rd party partners if needed. One for booking,...
- 545
16
votes
1
answer
4k
views
Should I split my API by user type?
Let's say I have an app to manage sporting teams. Potential users have a role of 'coach', 'player', and 'fan'. In many cases they will have to make similar api calls to retrieve info like this:
/api/...
- 271
13
votes
8
answers
1k
views
Punishing users for insecure passwords [closed]
I'm thinking about limiting the rights of users who choose insecure passwords (insecurity of a password being determined by length, how many types of characters (upper/lower case, numbers, symbols, ...
- 2,480
12
votes
2
answers
12k
views
cookie vs. session vs jwt
I am reading up on authentication/authorization in web applications. Could anybody confirm/correct my current knowledge?
Cookies: in their early version, a text file with a unique client Id an all ...
- 231
12
votes
2
answers
7k
views
User authorization with microservices
Should microservices be responsible for handling their own authorization or you think it's better to have a separate authorization service that is shared across all or a subset (within the same ...
- 121
11
votes
4
answers
8k
views
Should it be a claim, a role or a policy?
The distinction between roles and claims is that roles describe a set of users and claims describe a property of a user. So there can be a role "Administrator", but there can also be a claim "...
- 512
11
votes
2
answers
5k
views
Prevent abuse to REST API endpoint
Question 1
I have a login API endpoint
http://127.0.0.1:8080/api/account/login
It checks if the phone number has been validated. If not it will call
POST http://127.0.0.1:8080/api/account/sendsms ...
- 241
10
votes
2
answers
6k
views
Auth options for distributed systems
I am in the process of designing 3 components that will work in symphony with one another:
A RESTful web service which requires BasicAuth over HTTPS on all calls, and which is what actually does all ...
- 4,800
9
votes
4
answers
3k
views
Best way to do Client side authorization for a single page JavaScript application?
I already have a solid back-end permissions authorization (ie. admin can perform an action, a normal user cannot perform an action).
However, I'm wondering if there is a better way to do a frontend ...
9
votes
2
answers
887
views
Imitating Exchange Server's "RBAC AuthZ" in my own application... (is there something similar?)
Exchange 2010 has a delegation model where groups of winrm cmdlets are essentally grouped into roles, and the roles assigned to a user.
(Image source)
This is a great & flexible model ...
- 6,032
8
votes
3
answers
12k
views
Authentication and authorization - front-end vs back-end dilemma
I'm working on centralized authentication and authorization API system and got stuck in front-end vs back-end dilemma.
Front-end person is telling that should to have only one request to that API to ...
- 329
8
votes
3
answers
2k
views
OAuth alternative for a 2 party system
I'm writing a RESTful service (Java EE, Jersey) and a client application that communicates with it, and I wish to secure it and store any usernames & passwords dedicated in my own database.
I do ...
- 183
8
votes
4
answers
4k
views
Correct Way to Implementing Authorization Checks in ASP MVC
In ASP MVC we have the Authorize attribute to perform check at either a controller level or at a controller method level. But what if you need to do check permissions inside a controller method e.g ...
- 291
8
votes
3
answers
384
views
Authentication via tokens
I'm relatively new to jwt.io and authentication and I'm using JWT.io in following manner.
Server Side
Once user logs in, I generate a token with userid embedded inside and pass it back to the user ...
- 241
8
votes
3
answers
3k
views
Best solution to authorize that a user is only allowed to modify/act with their own resources in a REST API
Background:
Currently in the process of building out a REST API, using node w/express and it is consumed by a mobile app and eventually a (modern browser based) website.
I'm trying to identify the ...
- 209
7
votes
2
answers
4k
views
Examples of permission-based authorization systems in .NET? [closed]
I'm trying to figure out how to do roles/permissions in our application, and I am wondering if anyone knows of a good place to get a list of different permission-based authorization systems (...
- 23.9k
6
votes
3
answers
535
views
Multi platform password storage with retrieval for applications with authorization?
I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use.
Are ...
- 373
5
votes
1
answer
6k
views
Dealing with permissions for the list of resource
I have a few big services, that uses the same database and tables for managing roles and permissions. Each service ask the database directly for the permissions.
Now I need to build a new service. ...
- 183
5
votes
1
answer
463
views
Should user and service-to-service authentications be separate?
Say I have a system with 5 microservices behind a gateway, and a user signs in through an IDP (OAuth)
A user U passes the access token in a request, and the call first reaches the gateway before it ...
- 161
5
votes
2
answers
717
views
Authorization checks without littering them in code
My team is currently trying to design an authorization system that can be used in any language (Think authorization as a service). One thing i'm trying to figure out is if there is a good way to write ...
- 153
5
votes
1
answer
400
views
How to keep inter-service authorization maintainable?
In our environment (as in many others), it is often the case that one microservice must call another in order to accomplish a task.
In our environment, authentication is clear enough - we have a ...
5
votes
1
answer
8k
views
Token based authentication and multiple sessions
I've a token based authentication system (REST) that I inherited for an iOS app (can't change), and I've to re-use the same authentication web api system (that I can change to adapt for the web ...
- 241
5
votes
2
answers
963
views
What are the different ways for performing authorization in a web application other than role-based authorization?
The most common approach used for authorization which I know is role based authorization. Instead of directly storing the access rights against the user ids you create roles and store the access ...
- 51
4
votes
3
answers
309
views
How can I improve this design so that I don't need to dynamically scan classes at runtime?
I'm in the middle of a redesign on the part of my current project that deals with user permissions and authorization. I have an interface named IUserPermissions that encapsulates this information.
...
- 4,518
4
votes
3
answers
1k
views
Authorization and Audit on models in MVC architecture
What are the best practices to extend Authorization to the Model layer if in a monolith MVC application (i.e rails) you have other entry-points than just the Controller? I.e background jobs, or the ...
- 229
4
votes
4
answers
15k
views
REST Service Authentication/Authorization
I have a WCF rest service that will be consumed by multiple clients. The information returned by the client requires me to know who they are, so that I can return information specific to them.
Is ...
- 479
4
votes
2
answers
738
views
Proper way to differentiate user types in OO
I'm designing an application where I have users and admins (further down in the future, I can have different sub-ranks, where each one can have access to some area of the application).
Currently, I ...
- 317
4
votes
1
answer
1k
views
OAuthv2 for distributed applications
Please note: Months ago I asked this question that received a truly amazing answer and introduction to OAuthv2. I’m now knee deep in the implementation of such a system and have similar (but notably ...
- 4,800
4
votes
1
answer
636
views
How to solve a general authentication problem for multiple applications?
At my current job (we're in a MS environment), we have multiple deployed web applications, both inter/intra net. The internal apps generally use an Active Diretory sign in, the forward facing sites ...
- 962
4
votes
1
answer
2k
views
REST API Design: Multiple resources and authorization
I'm working on a service that forwards/unifies our API calls to external platforms/services.
For example, let's say that I don't want to handle all possible actions (create post, retrieve post, edit ...
- 143
4
votes
1
answer
218
views
How to make sure media are used only on authorized sites?
I have a video library that I need to publish for my clients. The clients need to be able to embed a player into their sites and play the videos. I need to restrict access to my clients only so that ...
- 141
4
votes
0
answers
821
views
Identity and access management in Clean Architecture and MVC design
The application user has a lot of standard functionality we see in most applications. At a high-level, this includes some form of authentication, authorization, and session management. At a low-level, ...
- 181
4
votes
2
answers
706
views
Where should authorization live in an application using API gateway/lambda and openid?
For an application which:
Will use Google OpenID for account creation & authorization
I plan on allowing any user to "create an account" which is why I want to use Google for this
AWS API ...
- 12.1k
4
votes
0
answers
835
views
Oauth 2 store access token vs verifying on each call
Let's say my Server is both Authorization Server and Resource server
My Client (for example mobile app) can authenticate in 2 matters:
via Resource Owner Password Credentials Grant
via ...
- 227
4
votes
0
answers
98
views
Adding new service to authenticated website
So I've created an API that I want to leverage to add some functionality to an existing web app. My current website authenticates users using SAML. What I'm looking to do is instead of moving the code ...
- 183
3
votes
1
answer
828
views
What's the difference between policy vs permission based access control?
I am newbie at these stuff and while I was able to distinguish between role-based vs. policy-based authorization models, I can't seem to understand whether there is one between policy-based vs. ...
- 141
3
votes
2
answers
3k
views
SVN command line client: checkout refused when LDAP password changed “svn: OPTIONS of” (repo) “authorization failed” (but works in TortoiseSVN)
When using the command line/terminal svn client, a colleague is getting "svn: OPTIONS of " [repo] "...authorization failed" error message when they attempt to checkout the repo to be their local ...
- 923
3
votes
3
answers
24k
views
Database design for a role based access system?
I'm considering different designs for a generic role library gem.
The first is based off the Rolify gem but with a has_many through: relationship instead of HABTM. HABTM tables are "headless" in ...
- 286
3
votes
2
answers
3k
views
Microservices and authorization
We are currently working on a micro-service based system. The idea behind it is to split our monolithic system to small domains (micro-service per domain).
All services will be used by our internal ...
- 545
3
votes
1
answer
106
views
should you have separate application service methods for different roles
Say I have a shipping service where I have both a driver and a dispatcher, but there are multiple roles and a user can belong to more than one role. Both the driver and dispatcher roles can mark a ...
- 187
3
votes
3
answers
298
views
Auth in microservices applications with service mesh
Premise:
- Two services A and B
- Resource X has owner U, and is managed by service B
Now, I need to handle these auth scenarios:
1- End-user needs to directly use service B's API to access X
2- ...
- 139
3
votes
2
answers
258
views
How to safeguard a COTS REST API with on-premise servers for approved client apps only?
Goal: Prevent unauthorized 'clone' apps from using REST API-based solutions where the customers manage their own servers and services instead of the vendor doing so (database, resource, and identity). ...
