Authorised is not a Yes/No question
summary
Claim: authorization is not binary — use role-based then attribute-based checks. Demonstrates a React app with React + Auth0 SDK talking to an Express API that uses express-jwt and jwks-rsa to verify a JWT and read a permissions array in JWT. Builds roles (admin vs editor) and permissions (create/update/delete); editor tokens allow create/update but 403 on delete, admin tokens succeed, showing the approach works end-to-end.
AI-written summary · about
chapters (9)
- 0:00Authorization challenges
- 1:47Authentication vs authorization
- 3:11Attribute-based access control
- 7:39Role-based access control
- 9:23Choosing access control models
- 11:28RBAC demo setup
- 15:39Live authorization demo
- 22:48Testing user roles and permissions
- 23:28Q&A
related talks
21mAuthorised is Not a Yes/No Question
31mAuthorised is Not a Yes No Question
12mAuthentication and Authorization in Next.js
40mAuthentication and Authorization in GraphQL
58mImplementing authorization in web applications and APIs
29mWhy Authorization is Hard
33mAuth for React.js APP
39mAuthentication & Authorization Architecture in the MEAN Stack