3 ms·

We wrote a big-ol blog post about inter-service auth that has a lot of relevant stuff: https://latacora.micro.blog/2018/06/12/a-childs-garden.html https://latac

by lvh 8y ago

We wrote a big-ol blog post about inter-service auth that has a lot of relevant stuff: https://latacora.micro.blog/2018/06/12/a-childs-garden.html https://latacora.micro.blog/2018/06/12/a-childs-garden.html RLS means your database understands what a user is allowed to see and not allowed to see. It is usually much simpler to express authz in a SQL constraint than it is in code. It's also harder to forget, so you don't get an authz failure in like, one endpoint.

madeuptempacct 8y ago
I will check it out, thanks.
Boulth 8y ago
I wouldn't recommend Macaroons so lightly. I spent 2 months researching them for internal use, reimplemening them from the paper and comparing with existing implementations. There are numerous practical issues with Macaroons: the caveat format is not standardized (both binary and allowed claim types), that matters a lot when using third party caveats. There are some de facto formats but they are full of issues (e.g. date format not exactly ISO). Validation of a set of Macaroons requires walking a graph, that needs cycle detection, implementations that I've checked do not allow nested third party caveats, that invalidates one reason to use them. Attenuation is nice but it doesn't play nice with third party caveats (hash is used as a key for decryption, appending to a third party caveat changes hash). Then there are implementation errors such as: https://github.com/nitram509/macaroons.js/blob/master/lib/CryptoTools.js#L51 https://github.com/nitram509/macaroons.js/blob/master/lib/Cr... Some of these issues could be removed by slightly changing implementations but the de facto implementation basically froze it. (then there is a fact that the de facto impl already changed some aspects from the paper, e.g. calculation of hash for appended third party caveat).
geezerjay 8y ago
> We wrote a big-ol blog post about inter-service auth Wow what a treasure trove of goodness. Thank you!

by lvh 8y ago

madeuptempacct 8y ago

I will check it out, thanks.

Boulth 8y ago

I wouldn't recommend Macaroons so lightly. I spent 2 months researching them for internal use, reimplemening them from the paper and comparing with existing implementations. There are numerous practical issues with Macaroons: the caveat format is not standardized (both binary and allowed claim types), that matters a lot when using third party caveats. There are some de facto formats but they are full of issues (e.g. date format not exactly ISO). Validation of a set of Macaroons requires walking a graph, that needs cycle detection, implementations that I've checked do not allow nested third party caveats, that invalidates one reason to use them. Attenuation is nice but it doesn't play nice with third party caveats (hash is used as a key for decryption, appending to a third party caveat changes hash). Then there are implementation errors such as: https://github.com/nitram509/macaroons.js/blob/master/lib/CryptoTools.js#L51 https://github.com/nitram509/macaroons.js/blob/master/lib/Cr... Some of these issues could be removed by slightly changing implementations but the de facto implementation basically froze it. (then there is a fact that the de facto impl already changed some aspects from the paper, e.g. calculation of hash for appended third party caveat).

geezerjay 8y ago

> We wrote a big-ol blog post about inter-service auth Wow what a treasure trove of goodness. Thank you!