#Authorization
21 articles
8 Books for Learning Web Application Security (Auth and Secure Design)
A staged reading list of 8 books for learning web application security, from authentication and authorization to secure design: OAuth-based authorization, digital identity, and secure design and implementation. Each entry links to its full review.
What are Sender-Constrained Tokens? An Introduction to mTLS (RFC 8705) and DPoP (RFC 9449)
Explains sender-constrained tokens that address the weakness of bearer tokens, using mTLS (RFC 8705) and DPoP (RFC 9449) to bind a token to its sender, plus Resource Indicators (RFC 8707) that narrow the audience.
Access Token Validation and Revocation: Introspection, JWT, and Token Revocation (RFC 7009)
Compares the two access token approaches (opaque + Introspection / JWT access tokens) and how each is validated, plus revocation via Token Revocation. Covers RFC 7662, RFC 9068, and RFC 7009.
OAuth 2.1 and the Security BCP: RFC 9700 and RFC 6819 (Changes from OAuth 2.0)
An overview of the changes from OAuth 2.0 to 2.1 and the security measures shown by RFC 9700 Security BCP and RFC 6819 threat model. Covers mandatory PKCE, deprecation of the Implicit grant, Mix-Up defenses, and more.
Everything About Digital Identity: Knowledge for Realizing a Secure and User-Centric Identity System
A review of a comprehensive book on digital identity. It explains everything from concepts to implementation systematically and broadly, covering OAuth 2.0, OpenID Connect, SAML, zero trust, and decentralized identity, giving engineers who design and operate authn/authz platforms a wide perspective.
Introduction to Digital Identity: Essential Authentication, Authorization, and ID Management for Web Services
A review of Introduction to Digital Identity. A book that plainly explains the basics of authentication, authorization, and ID management for web services, with real examples. It spans the mechanisms of OAuth 2.0, OpenID Connect, and SAML through single sign-on, social login, and using IDaaS, an ideal primer.
OAuth 2.0 Explained: Complete Guide to Flows, Tokens, and Implementation
OAuth 2.0 explained from the specs (RFC 6749 and RFC 6750): the four roles, the four grant types, access and refresh tokens, endpoints, scopes, Bearer tokens, security considerations, and what OAuth 2.1 changes.
Summary of OpenID Connect 1.0 Specifications
Understand OpenID Connect specification, JWT structure, ID tokens, claims, and authentication flow details.
SAML 2.0 Explained: How SSO and Federated Identity Work
Understand SAML 2.0 and how it enables Single Sign-On (SSO), the roles of Identity Provider and Service Provider, and how it compares to OAuth 2.0 and OpenID Connect.
Session-based and Token-based Authentication Methods
A comprehensive comparison and explanation of session-based and token-based authentication methods, covering technical details and implementation considerations.
Access Control Patterns Using OPA
Explore four access control patterns using Open Policy Agent including Allow/Deny, SQL generation, and AST approaches with responsibility separation.
Considerations and Solutions for Pagination Impact in OPA
Master pagination with Open Policy Agent, offset pagination, cursor pagination, and access control filtering.
About Row Level Security (RLS) in PostgreSQL
Master PostgreSQL Row Level Security with PERMISSIVE and RESTRICTIVE policies for multi-tenant data isolation and access control.
What is Open Policy Agent (OPA)? A Practical Guide to Policy as Code
Learn what Open Policy Agent (OPA) is, how policy as code works, and practical examples of using OPA to centralize authorization logic in your infrastructure.
Implementation of Access Control System for Microservices Using OPA
Implement fine-grained access control for distributed microservices using Open Policy Agent and declarative Rego policy language.
Case Study on Authorization Management Infrastructure
Explore authorization management infrastructure case studies from freee on team structure, microservices, and QA practices.
Exploring Permission Management Design
Understand ACL, RBAC, and ABAC permission design methods with functional/data scope, control targets, and operational constraints.
Resources for Catching Up on OAuth2 and OIDC
Explore OAuth2, OIDC, JWT, and authentication standards through comprehensive specifications, books, and implementation guides.
A Book to Understand the Differences Between OAuth, OAuth Authentication, and OpenID Connect
A review of a book that helps you understand the differences between OAuth, OAuth authentication, and OpenID Connect. It clearly sorts out these easily-confused concepts for beginners, offering a starting point for understanding the role and proper use of each.
Basics of Authentication and Authorization
Learn authentication and authorization fundamentals: identification, RBAC, ABAC, credential types, SSO, SAML 2.0, OAuth 2.0, and OpenID Connect with practical context.