Questions tagged [authorization]
The authorization tag has no usage guidance.
173
questions
1
vote
0
answers
77
views
How to model ACLs?
There are different kinds of ACLs I've generally implemented:
Does a user have access to a resourcetype(API)?
Does a user have access to a resource(Object)?
Does a resource have access to another ...
- 19
2
votes
2
answers
2k
views
Multitenancy with Cross-Tenant Users
We currently have a requirement to build a multi-tenant application that has cross-tenant users. That is the business data is separated by tenant but users can belong to multiple tenants and should ...
- 313
2
votes
1
answer
142
views
What are some authorization based design patterns to limit functionality from the perspective of size or amount of data?
I am well aware of role based / activity based authorization in the context of limiting user functionality in a simple on/off manner; however, the problem gets difficult when it's not so black and ...
- 175
1
vote
1
answer
227
views
Do authorization checks belong in the controller or the repository/persistor
I have a Laravel project where the controllers (all derived from one of two base controllers) use repository and persistor classes to interface with Eloquent models. Authorization logic is implemented ...
- 155
2
votes
0
answers
38
views
How authorize web application and manage sessions
i am building a single page react app that uses redux as state manager and an express node js as backend server but i don't know what is the best way to authorize my users in the application!
if it ...
- 129
3
votes
1
answer
106
views
should you have separate application service methods for different roles
Say I have a shipping service where I have both a driver and a dispatcher, but there are multiple roles and a user can belong to more than one role. Both the driver and dispatcher roles can mark a ...
- 187
8
votes
3
answers
12k
views
Authentication and authorization - front-end vs back-end dilemma
I'm working on centralized authentication and authorization API system and got stuck in front-end vs back-end dilemma.
Front-end person is telling that should to have only one request to that API to ...
- 329
2
votes
2
answers
2k
views
Dealing with property-level permissions in DDD and should UI or authorization influence the domain model?
Suppose I have a command like below:
public sealed class UpdateExampleCommand
{
public int Field1 { get; set; }
public string Field2 { get; set; }
public bool Field3 { get; set; }
...
3
votes
0
answers
139
views
Designing ABAC-style Authorization module with Row-level security
I'm designing the Authorization part of the AAA module of a business software suite.
Requirements:
There are Users and Groups, and you can assign Permissions to any of those.
You can Grant or ...
- 67
2
votes
2
answers
2k
views
How to efficiently pass permissions that control view and access of specific front-end elements from backend to the SPA using JWT
I would like to introduce permissions based access control in my Single Page Application (SPA) front-end which authenticates the user with token based authentication (JWT).
Permission Requirement:
...
- 171
5
votes
1
answer
400
views
How to keep inter-service authorization maintainable?
In our environment (as in many others), it is often the case that one microservice must call another in order to accomplish a task.
In our environment, authentication is clear enough - we have a ...
1
vote
4
answers
2k
views
How to handle user permission changes in SPA?
I have a SPA which at the beginning of application startup calls the backend API, sends a JWT and asks for the access permissions of the current user. SPA then caches the permissions in-memory and ...
- 157
0
votes
0
answers
93
views
Prevent token sharing: chained single-use tokens VS a designated invalidation feature
Situation:
A Client is requesting a resource from a Host multiple times, usually with minutes or hours between requests.
The Client has a signed, verifiable token, which we'll call a Receipt, that ...
- 404
0
votes
2
answers
352
views
Is creating a leaderboard web API that can't be fudged possible?
Let's say you have a game, and players of your game can get scores. You also want to be able to post these scores to a server using calls to a web API. Obviously, you want to be able to tell who sent ...
- 103
3
votes
2
answers
290
views
Where to put domain knowledge for Authorization?
I hope this is the correct SE site for this kind of question.
My team is currently developing an application which IMO needs access control beyond RBAC. Users can have access rights to entities based ...
0
votes
1
answer
166
views
Authorization & Profiles considerations for ASP.NET MVC Customer Portal
there's an up and running self-serve customer portal built that I'm trying to make a bit better when it comes to displaying proper items for different client types and auto-logging users. Here are a ...
0
votes
0
answers
133
views
Asynchronous Micro-Service Authorization
I have the following setup for my application:
A User logs in and is granted a Session Token.
When making API requests to Service A the User provides the Session Token.
All requests go through an API ...
1
vote
1
answer
2k
views
How to support anonymous user in web application?
I work for a publishing company that also provides content distribution to their users. In order to access a piece of content the user must be entitled to do so. Traditionally this authorization check ...
- 27
2
votes
0
answers
34
views
OAuth2 - client_credentials
I am in the process of building out a private REST API. This API is intended for machine to machine communication. In short someone else's server will kick off a job via CRON that pulls information ...
- 121
4
votes
3
answers
1k
views
Authorization and Audit on models in MVC architecture
What are the best practices to extend Authorization to the Model layer if in a monolith MVC application (i.e rails) you have other entry-points than just the Controller? I.e background jobs, or the ...
- 229
2
votes
0
answers
205
views
Viable ways to handle an access token on the resource/web application server
Use case:
We have a product which ties a set of resources to a concrete user.
Now we would like to provide the customers with an API so that an automated client application can have access to a ...
3
votes
0
answers
979
views
Authorization, permissions, and scoping resources in a microservice/DDD architecture
I'm building a microservice-based application (services according to DDD) and am about to implement authorization service. There are API gateways and UI applications that access backend servers, and ...
- 209
1
vote
1
answer
1k
views
Multiple app authentication, universal user login, best practice
Please see the below diagram.
There are two apps that each have a different set of functions, User A is a user of App1 and User B is a user of App2. They should not be able to log in directly to the ...
- 11
0
votes
0
answers
1k
views
How to handle role based access in my microservice architecture
We are trying to move from a monolith application to a microservice architecture faced by a spa application. One of the reason, is that we want to expose some services of our business to partners and ...
- 231
1
vote
1
answer
244
views
Help with definition of broad user types
I am trying to define the boundary between two broad types of users. The first are those who make use of corporate systems (accounting, ERP, CRM, etc.) and this also includes B2B users, for example ...
- 129
11
votes
4
answers
8k
views
Should it be a claim, a role or a policy?
The distinction between roles and claims is that roles describe a set of users and claims describe a property of a user. So there can be a role "Administrator", but there can also be a claim "...
- 512
3
votes
2
answers
258
views
How to safeguard a COTS REST API with on-premise servers for approved client apps only?
Goal: Prevent unauthorized 'clone' apps from using REST API-based solutions where the customers manage their own servers and services instead of the vendor doing so (database, resource, and identity). ...
1
vote
1
answer
76
views
What is the best way to implement model property authorization in an ASP MVC?
We have an MVC application that has very granular and configurable authorization. We currently have been using the authorize attribute against our controllers and controller functions.
The next ...
- 19
-2
votes
1
answer
115
views
How to migrate an existing ASP.NET MVC site to ASP.NET MVC Core - specifically on authorization
I am in the process of upgrading an existing website to ASP.NET Core 2.1. The goal is simplification and ease of maintenance. Existing site is using:
EF and .NET 4.6.2
A [Users] table in SQL Server ...
- 109
2
votes
1
answer
273
views
Architecture - Whether/Where to store 3rd party IDs
I've got an application where users can log in with varying levels of permissions. From their client they send a username & password to the front end, which passes it to the back end, and from ...
0
votes
2
answers
435
views
RESTful API authorization for updatable fields
I've got a resource as follows where state is a enum:
{
id: 123,
industry: {
id: 245,
name: "Farming"
},
"scheduleDate": "2018-01-01",
"state": "Requested|Approved|Standardized|...
-1
votes
1
answer
28
views
How to implement linkedin authentication/data sharing with multi party?
Hi I am working on application 2.
My application interacts with application 1 and 3.
Clients of application 1 need to be to share their linkedin profile information with application 3.
I have ...
5
votes
1
answer
6k
views
Dealing with permissions for the list of resource
I have a few big services, that uses the same database and tables for managing roles and permissions. Each service ask the database directly for the permissions.
Now I need to build a new service. ...
- 183
1
vote
1
answer
792
views
Authorization and Domain Model
I have an enterprise system that is represented by a domain model, part of the requirement that the system should limit access to some of the features based on privileges of the logged in user.
...
- 369
3
votes
1
answer
577
views
How to delegate the refresh token renewal in a SOA
So, we've got SOA on the backend (BE) and on the frontend (FE) we've got micro-frontends (the separate micro-frontends are loaded as components into the frontend app when needed, so internal process ...
- 171
3
votes
1
answer
848
views
Designing authentication and authorisation micro service
Background:
There are three different applications A, B and C and they all share same user details but I had to implement authentication in each of them which was duplication of effort.
After some ...
- 2,146
9
votes
4
answers
3k
views
Best way to do Client side authorization for a single page JavaScript application?
I already have a solid back-end permissions authorization (ie. admin can perform an action, a normal user cannot perform an action).
However, I'm wondering if there is a better way to do a frontend ...
4
votes
1
answer
2k
views
REST API Design: Multiple resources and authorization
I'm working on a service that forwards/unifies our API calls to external platforms/services.
For example, let's say that I don't want to handle all possible actions (create post, retrieve post, edit ...
- 143
35
votes
3
answers
24k
views
Implementing DDD: users and permissions
I am working on a small application trying to grasp the principles of domain-driven design. If successful, this might be a pilot for a larger project. I'm trying to follow the book "Implementing ...
- 463
0
votes
1
answer
521
views
Anonymous Controller/Action within Authorized Site
Say I have an MVC .net core website where 100% of the controllers/methods are behind [Authorize] attributes (complete with policies and all).
Would it be taboo, to carve out a set of un-authorized/...
- 125
1
vote
2
answers
903
views
Is there a valid alternative to HTTP headers for sending auth credentials
I have built simple auth for REST servers in academic projects. I always used the headers to pass the credentials. This is probably just because every tutorial I've ever seen did it this way. ...
- 119
-1
votes
1
answer
88
views
Does Policy-Based authentication remove refactoring security?
I understand Role Based Security.
I have read about Policy Based.
I have read what others call Activity Based.
What I want to know is if I do Policy-Based, am I avoiding what Role-Based requires and ...
- 3,669
2
votes
4
answers
702
views
Synonym for "Authorization"?
I think a lot of new comers get confused because these two terms look and sound similar:
Authentication
Authorization
I think "Authentication" is well known, I will use this term.
But for some docs ...
- 180
2
votes
2
answers
2k
views
How to secure web services when authentication is done at client side (frontend)
I have web application which structure is as-
webapi : django web services [NOT REST] no security implemented
frontend : Angular2. authentication implemented via SAML
Database : Mongodb
Can you ...
- 31
22
votes
3
answers
16k
views
Is it bad practice to store a user's email address in a JWT?
I'm using JWTs for user auth in a web application. I have a user db where each user's unique ID is their email address. To identify the subject of the JWT, I currently have a claim which stores the ...
- 391
20
votes
1
answer
19k
views
Difference between 'aud' and 'iss' in jwt
I want to implement a more robust authentication service and jwt is a big part of what I want to do, and I understand how to write the code, but I'm having a little trouble understanding the ...
- 381
12
votes
2
answers
12k
views
cookie vs. session vs jwt
I am reading up on authentication/authorization in web applications. Could anybody confirm/correct my current knowledge?
Cookies: in their early version, a text file with a unique client Id an all ...
- 231
1
vote
1
answer
5k
views
Microservices session data when communicating internally
I'm not sure the title is correct, so please advise if you think of a better title.
The scenario is:
We have an API gateway that exposes REST API to our clients (web and
mobile apps).
We have a "...
- 111
0
votes
1
answer
250
views
Remote authorization on each REST resource request
We have a microservices architecture. One of the components is an Authentication & Authorization Service, which implements OAuth2 standard using encrypted JWTs. On each authentication of a user to ...
- 111
16
votes
1
answer
4k
views
Should I split my API by user type?
Let's say I have an app to manage sporting teams. Potential users have a role of 'coach', 'player', and 'fan'. In many cases they will have to make similar api calls to retrieve info like this:
/api/...
- 271