Topic hub
Authorization
RBAC, ABAC, ReBAC, scopes, multi-tenancy and object-level checks: deciding what a user may do.
Lessons
- Permissions, Roles and Object-Level Checks · FastAPI: From Basics to Production
Authorize actions with role dependencies and ownership checks. - Method Security and Object-Level Authorization · Spring Boot: From Basics to Production
Protect service methods with @PreAuthorize and ownership checks. - Authorization Models: RBAC, ABAC and ReBAC · Authentication & Authorization Architecture
Model who can do what, from simple roles to attributes and relationships. - Multi-Tenant Isolation · Authentication & Authorization Architecture
Keep each customer's data separate in shared infrastructure. - Centralized Authorization and Policy Engines · Authentication & Authorization Architecture
Externalize authorization decisions with OPA, Cedar, OpenFGA and friends. - Service-to-Service Authentication · Authentication & Authorization Architecture
Identity for workloads: client credentials, mTLS, workload identity and token exchange. - Authentication and Field-Level Authorization · GraphQL in Production
Where auth lives in GraphQL and how to avoid data leaks. - Broken Object Level Authorization (BOLA) · API Security in Depth
The #1 API risk: checking that the caller may access this specific object. - Object Property Level Authorization: Mass Assignment & Data Exposure · API Security in Depth
Control which fields each caller may read and write. - Scopes, Roles & Fine-Grained Authorization · API Security in Depth
Coarse scopes in tokens, fine-grained decisions in a policy layer. - Broken Function Level Authorization · API Security in Depth
Deny-by-default route permissions and hidden admin endpoints.
Cookbook recipes
- Implement role-based access control in FastAPI · FastAPI
- Isolate tenants in a multi-tenant FastAPI app · FastAPI
- Protect routes in the Next.js App Router · Next.js
- Protect routes in a React SPA · React