Search for a command to run...
Articles tagged with #authorization
Subscribing a client to a channel after login is not the same as authorizing every event you later push on that socket. The bug pattern User connects with a valid session. Server joins them to tenant
Soft-delete is a data lifecycle choice. Authorization is a security decision. Mixing them up is how tombstoned rows keep answering "yes" long after the product thinks they are gone. The bug pattern A
Most ABAC bugs I see are not bad rules. They are stale inputs. The policy says something like "finance can edit records tagged confidential, but only during business hours." That looks fine in a desig
A common way to wire up an AI agent is to hand it the user's session or OAuth token and let it call APIs "as the user." It's quick, and it feels safe, because the agent can't do anything the user coul
A service-to-service token proves which machine called your API. It does not prove which human may see or change a specific resource. If an internal worker calls GET /invoices/4821 with a service JWT,
A feature flag can hide a button or route a request to a new code path. It does not decide whether this user may read that customer record. Treat flags as product rollout controls. After the flag chec
