What’s the simplest safe way to restrict a small internal tool to six users?
I built a small on-call tracker for my team in a few hours. The tracker itself was easy, but figuring out how to let exactly six people use…
authorization
What’s the simplest secure way to restrict a small internal tool to six users?
I built a small on-call tracker for my team in a few hours, but then spent most of the day trying to restrict access to six specific people.…
JWT or Database Sessions: Which Authentication Approach Fits a Typical Web App?
I'm building a web application and need to choose an authentication and authorization approach. I'm comparing signed JWTs, encrypted JWTs (JWEs), and database-backed sessions. Which option is generally…
JWT, JWE, or Database Sessions: Which Is Best for a Typical Web App?
I'm building a web application and need to choose an authentication and authorization approach. I'm comparing signed JSON Web Tokens (JWTs), encrypted JSON Web Encryption tokens (JWEs), and…
What’s the best way to support secure human API access without long-lived tokens?
We run an internal self-service platform API, and people need to access it from CLI tools and scripts. Right now, we create a static token, display it once…
What’s the best way to manage human access to an internal API?
We run an internal self-service platform API, and employees sometimes need to access it from command-line tools or scripts. Right now, we issue a static token, display it…
What are you using for authentication, authorization, and payments?
I've had several side-project ideas over the years but haven't launched one because I'm not very experienced with social login and account management, backend permissions, or secure payment…
Can a JWT Be Used as a Session in a Stateless Architecture?
I'm trying to clarify the relationship between sessions, JWTs, and stateless systems. A session seems to be a period of interaction in which some state is carried between…
How should I handle stale JWT group claims when permissions change mid-session?
I'm building a React and FastAPI application using AWS Cognito for authentication. Users receive JWTs containing their Active Directory group memberships in a custom claim, and the backend…
How Can I Control API Access for Regular and Paying Users?
I'm working on a system using an Express.js API and a frontend website where users log in with their credentials to interact with the API. My company wants…
How is Authorization Managed Differently on Android Compared to PCs?
I'm curious about how authorization works on Android devices versus PCs. My understanding is that UNIX systems trust the user, which is why when I run applications like…
Understanding the Role of an API Gateway in Microservice Architectures
I'm trying to wrap my head around what an API Gateway does, especially in the context of a microservice architecture. Is it accurate to say that an API…
How can I implement a custom authorization system for my AWS-based PaaS?
I've built a basic Platform as a Service (PaaS) on AWS, and now I'm looking to set up a robust system for managing user authorizations. My setup includes…
Looking for Comprehensive Tutorials on Authentication and Authorization
I'm trying to learn about authentication and authorization, but all I can find are scattered pieces of information, not a comprehensive tutorial. How did you all learn about…
Are JWT Tokens Considered Session Data?
I'm trying to wrap my head around the differences between JWT tokens and HTTP sessions. My understanding is that an HTTP session is the time when a client…
What are the best practices for managing authorization in AWS?
I'm looking for guidance on the best practices for managing authorization in AWS. Specifically, I'm wondering about the different methods to authenticate and authorize users or roles, especially…
How to Pull Images from AWS ECR in a k3s Cluster?
Hey everyone! I'm currently setting up a k3s cluster within a Proxmox environment. While things are generally going well, I'm struggling to pull images from my private AWS…