New answers tagged authentication
What I am missing here ? "s". You need to be using https, which is end-to-end encrypted, not "raw" http.
1) The Resource Server has to check back with the Authorization Server to make sure the token is still valid. This usually involves making a request and getting a response back. 2) One of the properties of an OAuth2 access token is the scope that it got when the Authorization Server granted it. So usually when the Resource Server checks, the Authorization ...
It sounds like authentication (who the user is) and authorization (what the user is allowed to do) are not as clearly divided as you would like. If you don't want the authentication server to know what the user is entitled to then limit the claims in that JWT to the userid just like wchoward suggested. You could have another server known as the ...
Should I rely solely on mongoose's validation for input validation, or should I write my own before it even gets to mongoose? I think that kind of checks should be done by your service, between DB and HTTP modules, not inside DB. For output filtering, should I create a security / filtering module which accepts a Product and returns a ...
Top 50 recent answers are included