We can't find the internet
Attempting to reconnect
Something went wrong!
Hang in there while we get back on track
Adam Hopkins - Overcoming access control in web APIs
Learn how to overcome access control in web APIs by considering authentication and authorization separately, using tokens and header-based security measures, and implementing structured scopes and protection methods to ensure secure and controlled access.
- Consider authentication and authorization separately; authentication is about “who is this person?”, while authorization is about “are they allowed to do this?”
- Use tokens to store authentication information, but avoid storing sensitive information in cookies
- Browsers are a problem because they can’t handle security features like HTTP-only cookies; use header-based security measures instead
- JWTs are a common way to handle authentication, breaking into three parts: namespace, action, and signature
- Use structured scopes to handle authentication and authorization; structured scopes are a way to define permissions without storing them in a database
- Don’t rely on cookies for authentication; instead, use header-based security measures
- Use a protection method to validate tokens and prevent unauthorized access
- Remember that authentication failure is a 401 status code, and authorization failure is a 403 status code