4 ms·
IMHO the best way to do authorization if your application otherwise works completely in the frontend: Rent a tiny VM for $5/month and set up a small "enter you
by TekMol 3y ago
IMHO the best way to do authorization if your application otherwise works completely in the frontend:
Rent a tiny VM for $5/month and set up a small "enter your email, you'll get a magic link" application you write in Python or PHP.
And proxy whatever API access you want to restrict to authorized users through a simple Python or PHP script which can just be a few lines of code. It looks up the cookie set by the magic link, checks if it is allowed to access the endpoint and if yes proxies the request.
- orweis 3y agoThat sounds more like Authentication (verify identity) than Authorization (decide specifically what they are allowed to do per request), no?
- TekMol 3y agoWithout identity, how would you decide if a user can access a resource or not?
- orweis 3y agoOf course you need identity (FoAz uses JWTs from authN solutions - can also be your VM (if it produces a JWT as it's magic link process)) , but Authorization is another step on top. e.g. You are Dave@customer.io (or some other verified identity), I know you, but how many SMS messages should I allow you to send via Vonage or Twilio when you click the button in the app? Managing that quota is an example of authorization.
- kolmel 3y agoThat doesn't change the fact that they're separate but related concerns. Authentication is enforcing that someone is who they say they are, and authorisation is checking that that person is allowed to access a secure resource. Looks like FoAz just solves the authorisation problem, allowing you to use another authentication provider.