4 ms·

What do you do with this?

• Aissen 4y ago
  For example, handle decentralized authorizations and attenuation in a distributed system: https://www.biscuitsec.org/docs/getting-started/introduction/ https://www.biscuitsec.org/docs/getting-started/introduction... I think the lack of real-life examples Biscuit's power and usefulness is the missing piece in the docs. Because they are a building block often used in proprietary systems, people can't even imagine what they could be used for.
  • poizan42 4y ago
    What does attenuation refer to in an authentication context? From the word I would guess it would be something like being able to make another token with fewer rights/less access from a more powerful token without involving the issuer. Edit: Seems my guess was right: > But it does a lot more! It supports offline attenuation (like Macaroons): from a Biscuit token, you can create a new one with more restrictions, without communicating with the service that created the token.
  • vlmutolo 4y ago
    They provide some examples in the “Recipes” section of the navigation menu at the bottom of the page. Here’s their example of implementing role-based access control: https://www.biscuitsec.org/docs/guides/rbac/ https://www.biscuitsec.org/docs/guides/rbac/