A cached permission is not forever

UpdatedSeptember 27, 2026

•1 min read•View as Markdown

Auth By Example

Practical lessons on auth, authorization, and access control.

Caching "can this user edit invoice 42?" is fine for latency. Caching forever is how yesterday's revoke becomes today's silent allow.

If you cache authorization decisions:

Key them on actor + action + resource (and tenant)
Cap TTL tightly
Invalidate on role, permission, or membership changes
Prefer re-checking on writes even when the cache says allow

Authn tells you who. Authz decides each action. A warm cache does neither if it is stale.

#security #authorization #api #backend

Comments

Join the discussion

No comments yet. Be the first to comment.

More from this blog

Check that the recipient can read the record before you send the notification

Someone @mentions a teammate in a comment on a private ticket. Your app emails the teammate a snippet of the comment and the ticket title. If that teammate was never given access to the ticket, you ju

Oct 6, 20262 min read

Your search index is a second copy of your data, so it needs the same permissions

A common pattern: the app checks permissions carefully on every detail page, then adds search later. Documents, tickets or messages get pushed into a search index, and the search endpoint returns what

Oct 5, 20262 min read2

An API key is not a user, so give it its own permissions

Most apps add API keys after the fact. A customer wants to script something, so the team adds a "Generate key" button and moves on. The quiet risk is what that key is allowed to do. The trap The key i

Oct 5, 20262 min read

A batch endpoint must authorize every item, not just the first

Bulk endpoints are handy: archive 50 documents, delete 20 comments, move 100 files in one call. They are also a quiet place for authorization to slip. The trap The handler receives ids: [...], loads t

Oct 5, 20262 min read1

A feature flag cohort is not authorization

A feature flag or experiment cohort decides which UI or code path you see. It is not a grant to read or change a specific object. The trap You gate a new “export invoices” button with flags.on('invoic

Oct 4, 20262 min read

A

Auth By Example

57 posts