Skip to main content
26 votes
Accepted

Should I split my API by user type?

No you shouldn't use level of access as part of the URI. There is already a standard way to separate API by user access, and that's with authorization. All users should access the same endpoints, and ...
Samuel's user avatar
  • 9,197
23 votes
Accepted

Where to place an API key: a custom HTTP header VS the Authorization header with a custom scheme

Be consistent Some may say this is unnecessary (and not too long ago I would have agreed) but these days, with so many auth protocols, if we use the Authorization header to pass an API key, it is ...
Laiv's user avatar
  • 14.7k
23 votes
Accepted

Is it bad practice to store a user's email address in a JWT?

Yes, it is bad practice and a security problem. Email addresses are PII (personally identifiable information). Like all other PII, email addresses should never be stored unencrypted at rest; doing so ...
alexwebb2's user avatar
  • 345
22 votes
Accepted

How to design role based access control?

Your design seems pretty close to me. Just a couple suggestions. users - People who will use the system. Here I have usernames and passwords. Fine roles - Collection of roles that users can ...
John Wu's user avatar
  • 26.6k
22 votes

How to design role based access control?

I would not use or implement RBAC. Instead I would use ABAC. Let me explain... RBAC or role-based access control is about user management and role assignment. In RBAC, you get to say that Alice is a ...
David Brossard's user avatar
21 votes
Accepted

Authorization and authentication system for microservices and consumers

Authentication and authorization are always good topics I will try to explain to you how we deal with authorizations in the current multi-tenant service that I am working. The authentication and ...
José María's user avatar
20 votes
Accepted

Difference between 'aud' and 'iss' in jwt

These are intended for scenarios where you have a token issuing authority that is not the same as the application that is the intended recipient. This may not be different for your application. But ...
Paul's user avatar
  • 3,317
17 votes

Is it bad practice to store a user's email address in a JWT?

The short answer is no. There should not be any problem because email is a valid and registered public claim. I have a user DB where each user's unique ID is their email ... Well, there's a ...
Laiv's user avatar
  • 14.7k
16 votes

Implementing DDD: users and permissions

I have run into the same questioning and am posting the answer I have come up with because it might give some additional vision on the topic, even though the discussion took place a while ago (still ...
Qortex's user avatar
  • 261
15 votes

Implementing DDD: users and permissions

Authentication and Authorisation is a bad example for DDD. Neither of these things are part of a Domain unless your company creates security products. The Business or domain requirement is, or ...
Ewan's user avatar
  • 77k
14 votes

Synonym for "Authorization"?

Using another word for "Authorization" or "Authentication" isn't helpful for writing documentation. Even though they're obscure, these two are already the most common words for those things, and any ...
Kilian Foth's user avatar
13 votes
Accepted

Dealing with permissions for the list of resource

To summarize my understanding of your question, you want: a centralized service that would handle all permissions and ideally this service would omit using the database directly without big ...
Michael C Good's user avatar
12 votes
Accepted

cookie vs. session vs jwt

Cookies: in their early version, a text file with a unique client Id an all the other information needed about the client (e. g. roles) Cookies are tuples key-value originally addressed to retain ...
Laiv's user avatar
  • 14.7k
9 votes
Accepted

What's the difference between policy vs permission based access control?

The classic example of policy based auth, which I'm sure you have seen if you have googled, is a alcohol selling app, which in (normal countries) would read: Allow user if user.age > 18 this is ...
Ewan's user avatar
  • 77k
9 votes
Accepted

In a web application, should "private" user images be protected with authentication/authorization?

I've come back to this question a number of times. To be honest, my expectation as a user is if I mark it private, then I wouldn't expect a direct link to work. But I'm a technologist. I have a ...
Greg Burghardt's user avatar
8 votes

cookie vs. session vs jwt

Cookies: in their early version, a text file with a unique client Id an all the other information needed about the client (e. g. roles) Your definition of cookie doesn't really describe what they do. ...
Samuel's user avatar
  • 9,197
8 votes
Accepted

Authentication and authorization - front-end vs back-end dilemma

The backend person might have omitted their valid justifications Back-end person claims that front-end should to have two calls. First to authenticate user (login process) with JWT response only ...
Flater's user avatar
  • 52.3k
7 votes
Accepted

Authorization checks without littering them in code

What you are asking for has a name, a model, and even implementations (open-source libraries as well as commercial products). Externalized Authorization Management What you are looking for is called ...
David Brossard's user avatar
7 votes

OAuth2 overkill for small business

You are right, OAuth2 is overkill in this specific case and despite the comments, it will add unnecessary complexity to the whole project. That being said, remember that OAuth2 is not an ...
Laiv's user avatar
  • 14.7k
7 votes
Accepted

Implementing DDD: users and permissions

It's sometimes difficult to distinguish between real access control rules and domain invariants borderlining on access control. Especially, rules that depend on data only available far into the ...
guillaume31's user avatar
  • 8,623
7 votes
Accepted

Should user and service-to-service authentications be separate?

There is no "ideal" here - it all depends on what you need. While focused on more modern technology, the core of your question is no different from ASP.Net's classic impersionation feature ...
Flater's user avatar
  • 52.3k
6 votes
Accepted

Microservices and authorization

No, you are not using tokens correctly. The idea is that you have an Auth service which issues tokens and Resource services which can validate the token and read the claims it contains. So the rather ...
Ewan's user avatar
  • 77k
6 votes
Accepted

OAuth2 overkill for small business

The problem with basic authentication over SSL is it depends on passing reversably-encoded user credentials with every API request. This is a security issue because unless you intend to make the user ...
Samuel's user avatar
  • 9,197
6 votes

Should it be a claim, a role or a policy?

Essentially you are describing a mapping of Role to Permission. I think this is pretty much covered by the standard [Authorize(Role=xxx)] on your controller actions, where the implied permission is ...
Ewan's user avatar
  • 77k
5 votes

User authorization with microservices

Each microservice should not have to do its own authentication, but it does need to do its own authorization. Source And this makes perfect sense. I'm assuming there is no doubt about central ...
Ashwani Agarwal's user avatar
5 votes

SOA/Microservices: How to handle authorization in inter-services communications?

I advise you to have an internal channel of communication between the microservices. For example, using some message broker like RabbitMQ internally to send/receive or publish/subscribe messages ...
Wahid Bitar's user avatar
5 votes

should you have separate application service methods for different roles

No, you should not. You should handle the logic for different roles within the method. In your example there will be one exposed method: pubic void completeDelivery(User user) { ... } There are a ...
Berin Loritsch's user avatar
5 votes

Multitenancy with Cross-Tenant Users

I agree with Robert H. that there is an overarching problem here with terminology. Your customer is not using the terminology consistently or correctly, so any requirements discussions using that ...
John Wu's user avatar
  • 26.6k
5 votes
Accepted

What identity and/or access data are JWT claims intended for?

JWT's can be used for anything you want the server side to communicate back to itself or other services in the ecosystem in a trusted manner through an untrustworthy client. The user principal, ...
svidgen's user avatar
  • 14.7k
4 votes
Accepted

What is the purpose of a multi-claims-based authorization system?

The goal is to have more flexibility by being able to combine multiple providers. In the past, switching between different providers could be very tricky, and require a rewriting of every application ...
Arseni Mourzenko's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible