Skip to main content
Software Engineering

Questions tagged [authorization]

Ask Question

The tag has no summary.

184 questions
Newest Active Bountied Unanswered
Filter by
Sorted by
Tagged with
1 vote
1 answer
217 views

I am working on an identity and users service in a microservices system for which a passwordless, SMS-based authentication is a hard requirement, i.e. User enters their phone number System sends the ...
dzenesiz's user avatar
  • 227
3 votes
1 answer
703 views

I’m trying to clarify the difference between Role-based Access Control, Policy-based Access Control, and Access Control List when designing an authorization system. I have two scenarios: Scenario A I ...
Meitaiyang's user avatar
  • 43
4 votes
3 answers
228 views

We are designing a backend system for a large platform where users can interact with multiple products on behalf of different companies. We plan to use Keycloak as an external identity provider. The ...
ikiwq's user avatar
  • 165
2 votes
3 answers
426 views

Recently, I’ve found myself designing a microservices system, and I’m currently facing some challenges with authentication and authorization. Context All my microservices will be placed behind an API ...
ikiwq's user avatar
  • 165
3 votes
2 answers
327 views

So I just fell in a project where microservices are inside private subnets and therefore aren't reacheable through the internet. There is a balancer that can reach this microservices and this balancer ...
Matheus's user avatar
  • 219
4 votes
1 answer
180 views

I plan to have a frontend web app written with Next.js using the AuthJS library to provide user authentication using Oauth. This frontend application depends on a backend API. I want to make sure my ...
Romuloux's user avatar
  • 149
0 votes
2 answers
185 views

Let's say a user is authenticated to a website and can access a given page only if authorized to access it specifically, e.g. if the website has only these 2 pages https://my-classified-docs.com/page=...
Francesco B.'s user avatar
  • 121
0 votes
1 answer
294 views

I need to design a system that handles multiple types of resources, each having their own business logic and different types of actions available for those resources. The requirements are a natural ...
Nikola Dragić's user avatar
  • 3
0 votes
1 answer
171 views

Context: I have an API (using DDD) with an entity lets call it "Content" that only can be update by certain users. For example Content with Id = 1, can only be modified by User Id = 1, ...
Danielbahe's user avatar
  • 9
0 votes
0 answers
119 views

I'm designing a web application and using Microsoft's out of the box Identity and its default Two-Factor Authentication (with Asp.net core MVC and .NET 8). While setting up and testing the 2FA ...
eaglei22's user avatar
  • 147
1 vote
2 answers
227 views

Hi I have following structure : Client App (layer 1) Business logic Services ( Layer 2) Business Logic layer consists of many microservices . Access token can be created and passed from APP layer to ...
TechNjBat's user avatar
  • 17
4 votes
1 answer
958 views

When creating a web application that will allow users to upload images and mark them as private, should those images be protected by authentication and authorization mechanisms against access by other ...
SunSparc's user avatar
  • 185
0 votes
1 answer
551 views

Let's say we want to return a paginated list of document id that a user can view. In DB, we have: doc_id user_id ABC user_1 def user_1 ... ... We use an external authorization service, so we can query ...
janetsmith's user avatar
  • 139
1 vote
0 answers
213 views

Currently my company has 2 applications that use Identity Server for SSO. Not every client we have uses both applications but some do. The part I'm uneasy about is that both apps have a user ...
Brad Firesheets's user avatar
  • 146
0 votes
2 answers
426 views

I’ll try my best to explain, but for the closest context I could think of, imagine that I am building an analytics platform that allows paying users to sign up, place a tracking script on their ...
user8758206's user avatar
  • 121
2 votes
1 answer
132 views

We are trying to implement an authorization and authentication service for our product. Now, we would have to cater to different kinds of IAM systems like SSO, LDAP and Basic Username+Password in ...
Anirban Das's user avatar
  • 29
0 votes
2 answers
227 views

To best explain my context, imagine that I’m creating an alternative piece of software to google analytics (since my personal project’s principle is similar). Each unique user creates an account and ...
user8758206's user avatar
  • 121
-2 votes
1 answer
220 views

I have read this example:https://auth0.com/blog/securing-grpc-microservices-dotnet-core/ In this example it explains how to implement authorization in a gRPC service. It says that the client request a ...
Álvaro García's user avatar
  • 633
0 votes
2 answers
293 views

We have an ongoing argument in our team. Please help. Here is the problem: In our SPA web app, let's say we have a resource which can be edited by only those users who belong to the team of the user ...
user3563059's user avatar
  • 101
1 vote
0 answers
1k views

TLDR: I am trying to validate a Azure AD B2C access token in my Flask web API use scopes from that access token to authorize calling protected resources use timely and secure solutions such as PKCE ...
linus's user avatar
  • 121
0 votes
2 answers
320 views

I'm writing a webapp that serves users with different roles and permissions. One of the features of my application requires an API call to a secured endpoint. If the user doesn't have the correct ...
Nick Silvestri's user avatar
  • 113
1 vote
3 answers
432 views

Currently working on a project where we have multiple services that all need to consume the same authorization service when their endpoints are hit. Right now we have the authorization boilerplate ...
Astrum's user avatar
  • 143
0 votes
1 answer
948 views

I need to implement RBAC in a project I'm working on, and I'm fairly new to the concept. I am trying to figure out the best way to implement it. The most common approach seems to be to create roles ...
user3353167's user avatar
  • 149
1 vote
1 answer
409 views

I am currently developing an iOS application where there are options on the screen to edit and delete a list. Only the user who created this list can edit or delete it. I am struggling to determine ...
Trenton's user avatar
  • 17
0 votes
1 answer
713 views

I'm starting a project using Azure as our serverless framework. The project consists of two separate frontends applications that must talk to some backend services, some will be made by me and others ...
Mat-Tap's user avatar
  • 103
2 votes
4 answers
3k views

I'm working on moving some of our flags to a 3rd party system but I kinda have a hard time, determining what should be a feature flag and what should remain as authorization permission to a particular ...
Nobody's user avatar
  • 121
3 votes
1 answer
2k views

I am newbie at these stuff and while I was able to distinguish between role-based vs. policy-based authorization models, I can't seem to understand whether there is one between policy-based vs. ...
mlst's user avatar
  • 141
2 votes
0 answers
249 views

I want to know is if we should perform authentication at the API gateway, at the individual service, or both. Let's frame this question and descussion in the context of new development. Specifically, ...
Mike G's user avatar
  • 249
6 votes
1 answer
2k views

Say I have a system with 5 microservices behind a gateway, and a user signs in through an IDP (OAuth) A user U passes the access token in a request, and the call first reaches the gateway before it ...
Jerald Baker's user avatar
  • 171
1 vote
0 answers
599 views

We are currently in the early phases of developing several applications that differ significantly in their functionality. As part of building these applications, we have also developed a few generic ...
udnes99's user avatar
  • 59
0 votes
1 answer
562 views

We have a standard microservices setup (Identity Server, API Gateway, services, etc). Some of the services schedule events to be dispatched in the future (future = anything from mins to months ahead) -...
Keir's user avatar
  • 143
0 votes
1 answer
472 views

I am struggling to find a good solution for authorization of users after they were properly authenticated through an oidc flow. Let's assume the following setup: An angular SPA is interacting with ...
Marc Wittke's user avatar
  • 163
1 vote
0 answers
46 views

I would like to create GUI + API that calls third party API as follows: third party API is consumed once a day by my API, GUI user doesn’t have to log in every day (eg. can log in only once every 30 ...
jpawlowska's user avatar
  • 11
1 vote
2 answers
602 views

I'm looking for a way to avoid centralized management of authorization rules. I'd like every microservice to be responsible for the authorization logic of its actions, but I'm having some trouble ...
Gur Galler's user avatar
  • 119
1 vote
2 answers
651 views

So my current app process works like this: Client communicates with my API to get certain information My API needs information from a third-party API and uses these to create a response for the ...
hullunist's user avatar
  • 137
0 votes
2 answers
666 views

Generally most of the authorization in the system is done in authorization layer which then calls commands/queries from application layer, which call methods on domain aggregates. However there are ...
user606521's user avatar
  • 141
2 votes
1 answer
2k views

I am designing out an app that would have an Angular frontend and Spring Boot (Java) backend. I was considering (but not married to) the prospect of JWT-based authentication: User logs in with ...
hotmeatballsoup's user avatar
  • 91
0 votes
0 answers
99 views

Currently, I have a script install_crontab.py -u <user> -c <config> This script takes care of installing cron job that runs as a given user. In my install_crontab script, I check (using ...
ThinkGeek's user avatar
  • 119
2 votes
2 answers
179 views

What I'm trying to build REST-API using Express and SQLite 5 to 10 authors should be able to post articles to /articles except them, no one is allowed to post anything My approach to build it ...
Fanbneyl's user avatar
  • 129
2 votes
2 answers
759 views

My question may sound very naïve to someone, but it is what it is. I have below scenario: Relational MySQL Database with BIGINT primary keys and foreign keys Spring boot as a backend (technology ...
Jignesh M. Khatri's user avatar
  • 251
1 vote
1 answer
103 views

For my recent project I decided to leverage Authentication-as-a-Service, in particular I am using Auth0 but I do not think this particularly matters. I've got my React client set up correctly and I am ...
Jesse Brands's user avatar
  • 193
3 votes
1 answer
508 views

I have implemented authentication on an API Gateway level using NGINX+ and now I have concern if APIs behind it should still to authenticate using API Keys or JWT? What are best practices? My point is ...
JackTheKnife's user avatar
  • 389
2 votes
1 answer
440 views

I am an application developer and am building a token-based auth mechanism for my application. Essentially, the user will log in with username+password, if the credentials are valid, my code will ...
hotmeatballsoup's user avatar
  • 91
1 vote
1 answer
308 views

I have experience building RBAC-based authorization mechanisms, and understand the theory behind ACLs (DAC?) though I've never had the need to implement them. A situation was just presented to me that ...
hotmeatballsoup's user avatar
  • 91
1 vote
1 answer
689 views

I am building a REST API which would power a front end as well as other 3rd party apps and hence I want it to be as "standard" as possible. Right now, I am trying to stick to HATEOAS. The ...
Sayak Mukhopadhyay's user avatar
  • 229
1 vote
1 answer
2k views

We have a Web server (which also does authentication and authorization) that manages, via an API, one or more servers that contain highly sensitive data. In the below architecture diagram, we manage ...
Matthew Knill's user avatar
  • 493
1 vote
1 answer
478 views

I'm comfortable with a lot of OpenID Connect and OAuth2 concepts in the context of HTTP-based communication between microservices. I'm currently leveraging Azure AD. In the HTTP-based scenario I would ...
Burt's user avatar
  • 13
1 vote
1 answer
1k views

At my company we have a central auth server running IdentityServer. There are a number of applications providing some API to client applications. API requests are authenticated with JWT tokens issued ...
abdusco's user avatar
  • 119
1 vote
1 answer
327 views

Background: We're a smaller shop that puts out a number of products that require authentication and authorization. We're currently using a 3rd party service to "spin up new auth APIs" for ...
ClicheCoffeeMug's user avatar
  • 21
1 vote
1 answer
687 views

Example Application I will try to explain my problem by using a familiar application. Lets'say I'm building a Discord / Slack / Microsoft Teams clone; and for simplicity’s sake, it will contain 2 ...
Michiel's user avatar
  • 173

1
2 3 4