Search for a command to run...
Cron and queue workers often skip authorization because "there is no user." That creates a god-mode path. Give the job a service identity with the narrowest permissions it needs, and still check those permissions on every write so a bug in the worker cannot touch every tenant.
No comments yet. Be the first to comment.
A PUT that upserts feels like one endpoint. Authorization still has two decisions. If the resource already exists, you need update on that object. If it does not exist yet, you need create in the pare
Many APIs carefully scope list endpoints: GET /documents only returns rows for the caller's tenant. Then the detail route does: GET /documents/:id …and loads by primary key alone. If the caller can gu
When an API takes a path like /documents/123, that ID is a locator, not proof the caller may open the document. Authenticate the subject, then authorize against that specific object (and tenant) befor
Feature flags are great for rollouts. They are a poor substitute for authorization. A flag answers: “Is this code path on for this cohort?” An authz check answers: “Is this principal allowed to do thi
Auth By Example
12 posts
