Skip to main content

Questions tagged [authorization]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
70 votes
3 answers
36k views

Role vs Permission Based Access Control

I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization). Let's start with a given: in our system, a Permission will be a fine-...
smeeb's user avatar
  • 4,890
39 votes
1 answer
44k views

Where to place an API key: a custom HTTP header VS the Authorization header with a custom scheme

I'm designing a REST API using authorization/authentication via an API Key. I tried to figure out what is the best place for it and found out that many people suggest using a custom HTTP header such ...
RomanG's user avatar
  • 501
38 votes
3 answers
29k views

Implementing DDD: users and permissions

I am working on a small application trying to grasp the principles of domain-driven design. If successful, this might be a pilot for a larger project. I'm trying to follow the book "Implementing ...
LittlePilgrim's user avatar
30 votes
2 answers
47k views

How to design role based access control?

I am trying to follow the role bases access control model to restrict what users can or cannot do in my system. So far I have the following entities: users - People who will use the system. Here I ...
imran.razak's user avatar
25 votes
3 answers
20k views

Is it bad practice to store a user's email address in a JWT?

I'm using JWTs for user auth in a web application. I have a user db where each user's unique ID is their email address. To identify the subject of the JWT, I currently have a claim which stores the ...
Justin Borromeo's user avatar
23 votes
1 answer
6k views

SOA/Microservices: How to handle authorization in inter-services communications?

Foreground We are moving from a monolithic platform to a more Service Oriented Architecture. We are applying very basic DDD principles and splitting our domain across different bounded contexts. Each ...
Josep Serra's user avatar
21 votes
1 answer
23k views

Difference between 'aud' and 'iss' in jwt

I want to implement a more robust authentication service and jwt is a big part of what I want to do, and I understand how to write the code, but I'm having a little trouble understanding the ...
Adam McGurk's user avatar
21 votes
2 answers
19k views

Should I store my user claims in the JWT token?

I am using JWT tokens in HTTP headers to authenticate requests to a resource server. The resource server and auth server are two separate worker roles on Azure. I cannot makeup my mind as to whether ...
Astravagrant's user avatar
18 votes
5 answers
10k views

Authorization and authentication system for microservices and consumers

We plan to refactor our company system into a micro-service based system. This micro-services will be used by our own internal company applications and by 3rd party partners if needed. One for booking,...
Robert's user avatar
  • 555
16 votes
1 answer
4k views

Should I split my API by user type?

Let's say I have an app to manage sporting teams. Potential users have a role of 'coach', 'player', and 'fan'. In many cases they will have to make similar api calls to retrieve info like this: /api/...
Msencenb's user avatar
  • 271
13 votes
8 answers
1k views

Punishing users for insecure passwords [closed]

I'm thinking about limiting the rights of users who choose insecure passwords (insecurity of a password being determined by length, how many types of characters (upper/lower case, numbers, symbols, ...
Carson Myers's user avatar
  • 2,480
12 votes
2 answers
13k views

cookie vs. session vs jwt

I am reading up on authentication/authorization in web applications. Could anybody confirm/correct my current knowledge? Cookies: in their early version, a text file with a unique client Id an all ...
user3629892's user avatar
12 votes
4 answers
9k views

Should it be a claim, a role or a policy?

The distinction between roles and claims is that roles describe a set of users and claims describe a property of a user. So there can be a role "Administrator", but there can also be a claim "...
FCin's user avatar
  • 522
12 votes
2 answers
7k views

User authorization with microservices

Should microservices be responsible for handling their own authorization or you think it's better to have a separate authorization service that is shared across all or a subset (within the same ...
morcmarc's user avatar
  • 121
10 votes
2 answers
6k views

Auth options for distributed systems

I am in the process of designing 3 components that will work in symphony with one another: A RESTful web service which requires BasicAuth over HTTPS on all calls, and which is what actually does all ...
smeeb's user avatar
  • 4,890
10 votes
2 answers
6k views

Prevent abuse to REST API endpoint

Question 1 I have a login API endpoint http://127.0.0.1:8080/api/account/login It checks if the phone number has been validated. If not it will call POST http://127.0.0.1:8080/api/account/sendsms ...
momokjaaaaa's user avatar
9 votes
4 answers
4k views

Best way to do Client side authorization for a single page JavaScript application?

I already have a solid back-end permissions authorization (ie. admin can perform an action, a normal user cannot perform an action). However, I'm wondering if there is a better way to do a frontend ...
Christian Pavilonis's user avatar
9 votes
2 answers
899 views

Imitating Exchange Server's "RBAC AuthZ" in my own application... (is there something similar?)

Exchange 2010 has a delegation model where groups of winrm cmdlets are essentally grouped into roles, and the roles assigned to a user. (Image source) This is a great & flexible model ...
makerofthings7's user avatar
9 votes
3 answers
3k views

Best solution to authorize that a user is only allowed to modify/act with their own resources in a REST API

Background: Currently in the process of building out a REST API, using node w/express and it is consumed by a mobile app and eventually a (modern browser based) website. I'm trying to identify the ...
Ashtonian's user avatar
  • 219
8 votes
3 answers
13k views

Authentication and authorization - front-end vs back-end dilemma

I'm working on centralized authentication and authorization API system and got stuck in front-end vs back-end dilemma. Front-end person is telling that should to have only one request to that API to ...
JackTheKnife's user avatar
8 votes
3 answers
2k views

OAuth alternative for a 2 party system

I'm writing a RESTful service (Java EE, Jersey) and a client application that communicates with it, and I wish to secure it and store any usernames & passwords dedicated in my own database. I do ...
Alon Amir's user avatar
  • 183
8 votes
4 answers
5k views

Correct Way to Implementing Authorization Checks in ASP MVC

In ASP MVC we have the Authorize attribute to perform check at either a controller level or at a controller method level. But what if you need to do check permissions inside a controller method e.g ...
adam78's user avatar
  • 291
8 votes
3 answers
388 views

Authentication via tokens

I'm relatively new to jwt.io and authentication and I'm using JWT.io in following manner. Server Side Once user logs in, I generate a token with userid embedded inside and pass it back to the user ...
user2727195's user avatar
7 votes
2 answers
4k views

Examples of permission-based authorization systems in .NET? [closed]

I'm trying to figure out how to do roles/permissions in our application, and I am wondering if anyone knows of a good place to get a list of different permission-based authorization systems (...
Rachel's user avatar
  • 24k
6 votes
1 answer
1k views

Should user and service-to-service authentications be separate?

Say I have a system with 5 microservices behind a gateway, and a user signs in through an IDP (OAuth) A user U passes the access token in a request, and the call first reaches the gateway before it ...
Jerald Baker's user avatar
5 votes
1 answer
6k views

Dealing with permissions for the list of resource

I have a few big services, that uses the same database and tables for managing roles and permissions. Each service ask the database directly for the permissions. Now I need to build a new service. ...
alex's user avatar
  • 183
5 votes
2 answers
788 views

Authorization checks without littering them in code

My team is currently trying to design an authorization system that can be used in any language (Think authorization as a service). One thing i'm trying to figure out is if there is a good way to write ...
Catfish's user avatar
  • 153
5 votes
3 answers
647 views

Multi platform password storage with retrieval for applications with authorization?

I'm working on a development tool that requires knowing one or more api passwords for a user to operate. Currently it works on Mac, and uses keychain to store the credentials for later re-use. Are ...
Ralph Callaway's user avatar
5 votes
1 answer
451 views

How to keep inter-service authorization maintainable?

In our environment (as in many others), it is often the case that one microservice must call another in order to accomplish a task. In our environment, authentication is clear enough - we have a ...
Sebastian Lenartowicz's user avatar
5 votes
1 answer
9k views

Token based authentication and multiple sessions

I've a token based authentication system (REST) that I inherited for an iOS app (can't change), and I've to re-use the same authentication web api system (that I can change to adapt for the web ...
user2727195's user avatar
5 votes
2 answers
966 views

What are the different ways for performing authorization in a web application other than role-based authorization?

The most common approach used for authorization which I know is role based authorization. Instead of directly storing the access rights against the user ids you create roles and store the access ...
someperson's user avatar
5 votes
0 answers
914 views

Identity and access management in Clean Architecture and MVC design

The application user has a lot of standard functionality we see in most applications. At a high-level, this includes some form of authentication, authorization, and session management. At a low-level, ...
NLuburić's user avatar
  • 191
4 votes
1 answer
539 views

In a web application, should "private" user images be protected with authentication/authorization?

When creating a web application that will allow users to upload images and mark them as private, should those images be protected by authentication and authorization mechanisms against access by other ...
SunSparc's user avatar
  • 175
4 votes
2 answers
3k views

Multitenancy with Cross-Tenant Users

We currently have a requirement to build a multi-tenant application that has cross-tenant users. That is the business data is separated by tenant but users can belong to multiple tenants and should ...
Yuli Bonner's user avatar
4 votes
3 answers
312 views

How can I improve this design so that I don't need to dynamically scan classes at runtime?

I'm in the middle of a redesign on the part of my current project that deals with user permissions and authorization. I have an interface named IUserPermissions that encapsulates this information. ...
Brant Bobby's user avatar
  • 4,568
4 votes
3 answers
1k views

Authorization and Audit on models in MVC architecture

What are the best practices to extend Authorization to the Model layer if in a monolith MVC application (i.e rails) you have other entry-points than just the Controller? I.e background jobs, or the ...
VP.'s user avatar
  • 229
4 votes
4 answers
15k views

REST Service Authentication/Authorization

I have a WCF rest service that will be consumed by multiple clients. The information returned by the client requires me to know who they are, so that I can return information specific to them. Is ...
Brian Mains's user avatar
4 votes
2 answers
894 views

Proper way to differentiate user types in OO

I'm designing an application where I have users and admins (further down in the future, I can have different sub-ranks, where each one can have access to some area of the application). Currently, I ...
Tiago Duque's user avatar
4 votes
1 answer
1k views

OAuthv2 for distributed applications

Please note: Months ago I asked this question that received a truly amazing answer and introduction to OAuthv2. I’m now knee deep in the implementation of such a system and have similar (but notably ...
smeeb's user avatar
  • 4,890
4 votes
2 answers
1k views

Using Prolog to implement authorization rules

I'm working on a user management "pseudoframework" in PHP, and I'm trying to implement fine-grained rule-based authorization. I'm using a combination of SQL and condition-checking functions written ...
alexw's user avatar
  • 339
4 votes
1 answer
644 views

How to solve a general authentication problem for multiple applications?

At my current job (we're in a MS environment), we have multiple deployed web applications, both inter/intra net. The internal apps generally use an Active Diretory sign in, the forward facing sites ...
KevDog's user avatar
  • 962
4 votes
1 answer
2k views

REST API Design: Multiple resources and authorization

I'm working on a service that forwards/unifies our API calls to external platforms/services. For example, let's say that I don't want to handle all possible actions (create post, retrieve post, edit ...
Slav's user avatar
  • 143
4 votes
1 answer
218 views

How to make sure media are used only on authorized sites?

I have a video library that I need to publish for my clients. The clients need to be able to embed a player into their sites and play the videos. I need to restrict access to my clients only so that ...
akonsu's user avatar
  • 141
4 votes
2 answers
730 views

Where should authorization live in an application using API gateway/lambda and openid?

For an application which: Will use Google OpenID for account creation & authorization I plan on allowing any user to "create an account" which is why I want to use Google for this AWS API ...
enderland's user avatar
  • 12.1k
4 votes
0 answers
836 views

Oauth 2 store access token vs verifying on each call

Let's say my Server is both Authorization Server and Resource server My Client (for example mobile app) can authenticate in 2 matters: via Resource Owner Password Credentials Grant via ...
royB's user avatar
  • 217
4 votes
0 answers
98 views

Adding new service to authenticated website

So I've created an API that I want to leverage to add some functionality to an existing web app. My current website authenticates users using SAML. What I'm looking to do is instead of moving the code ...
ThrowsException's user avatar
3 votes
3 answers
2k views

OAuth2 overkill for small business

I'm currently in the process of writing an API that will interact with a web application, iPhone app, and Android app for my work. The API is pretty simple and deals with pilots and their ...
keelerjr12's user avatar
  • 1,229
3 votes
1 answer
2k views

What's the difference between policy vs permission based access control?

I am newbie at these stuff and while I was able to distinguish between role-based vs. policy-based authorization models, I can't seem to understand whether there is one between policy-based vs. ...
mlst's user avatar
  • 141
3 votes
2 answers
3k views

SVN command line client: checkout refused when LDAP password changed “svn: OPTIONS of” (repo) “authorization failed” (but works in TortoiseSVN)

When using the command line/terminal svn client, a colleague is getting "svn: OPTIONS of " [repo] "...authorization failed" error message when they attempt to checkout the repo to be their local ...
therobyouknow's user avatar
3 votes
3 answers
25k views

Database design for a role based access system?

I'm considering different designs for a generic role library gem. The first is based off the Rolify gem but with a has_many through: relationship instead of HABTM. HABTM tables are "headless" in ...
papirtiger's user avatar