--- title: Best Authorization posts of 2024 | daily.dev description: The most upvoted Authorization posts of 2024, curated by the daily.dev community. canonical: https://daily.dev/tags/authorization/best-of/2024 twitter:card: summary_large_image twitter:site: @dailydotdev og:url: https://daily.dev/tags/authorization/best-of/2024 og:type: website og:site_name: daily.dev og:title: Best Authorization posts of 2024 | daily.dev og:description: The most upvoted Authorization posts of 2024, curated by the daily.dev community. og:image: https://media.daily.dev/image/upload/s--VAY5ToZt--/f_auto/v1724209435/public/daily.dev%20-%20open%20graph --- # Best of Authorization — 2024 1. 1 [](/posts/oauth-2-0-flows-explained-in-gifs-beqiosycs "🔑 OAuth 2.0 flows explained in GIFs") Article Community Picks · 3y 🔑 OAuth 2.0 flows explained in GIFs This post explains OAuth 2.0 flows using GIFs. It covers the terminologies, the Authorization Code Grant flow, and other flows in OAuth 2.0. 247 5 2. 2 [](/posts/how-linkedin-authorizes-10-million-api-calls-per-second-qccaxvvwq "How LinkedIn Authorizes 10 Million API Calls Per Second") Article System Design Codex · 2y How LinkedIn Authorizes 10 Million API Calls Per Second LinkedIn utilizes Access Control Lists (ACLs) to manage access control at scale, facing challenges such as quick authorization checks, prompt ACL changes delivery, managing a large number of ACLs, and monitoring ACL data. They handle these challenges by running an authorization client module on every service, periodically refreshing ACL data, storing ACLs in a database with a cache, and logging authorization checks for monitoring purposes. 235 2 3. 3 [](/posts/permify-permify-an-open-source-authorization-as-a-service-inspired-by-google-zanzibar-designed-to--wjstrkasl "Permify/permify: An open-source authorization as a service inspired by Google Zanzibar, designed to build and manage fine-grained and scalable authorization systems for any application.") Article Hacker News · 2y Permify/permify: An open-source authorization as a service inspired by Google Zanzibar, designed to build and manage fine-grained and scalable authorization systems for any application. Permify is an open-source authorization service inspired by Google Zanzibar, designed to implement fine-grained, scalable access controls quickly. It centralizes authorization logic, supports granular permissions, and offers fast response times for access checks. Start using it locally with a simple Docker command and contribute to its codebase, documentation, or playground for improvements. 168 2 4. 4 [](/posts/how-to-use-reactjs-for-secure-role-based-access-control-jrdd1jag0 "How to use ReactJS for secure Role Based Access Control") Article Cerbos · 2y How to use ReactJS for secure Role Based Access Control ReactJS simplifies building interactive user interfaces through reusable components. By integrating Cerbos, a modern Authorization-as-a-Service solution, developers can efficiently handle authorization for an internal admin dashboard. Cerbos provides a flexible Policy Decision Point (PDP) that can be deployed in various environments, ensuring secure Role Based Access Control (RBAC). Using Docker, developers can test and implement policies to manage roles and permissions precisely, preventing unauthorized access to sensitive information and streamlining user role management. 166 18 5. 5 [](/posts/microservices-authentication-and-authorization-using-api-gateway-3ozhaevfd "Microservices Authentication and Authorization Using API Gateway") Article Awesome Go · 3y Microservices Authentication and Authorization Using API Gateway Learn about the challenges of authentication and authorization in a microservices architecture, the benefits of using an API Gateway for access management, and how JSON Web Tokens (JWTs) are used for authentication in microservices. 145 3 6. 6 [](/posts/build-a-login-and-logout-api-using-express-js-node-js--b1mx368cl "Build a Login and Logout API using Express.js (Node.js)") Article Community Picks · 2y Build a Login and Logout API using Express.js (Node.js) Learn to build a secure login and logout system using Express.js in Node.js. The tutorial covers setting up development files, installing dependencies, and creating a MongoDB database. It explains the basics of authentication and authorization, the logic for user registration and login, password hashing, and session management using JWT tokens. Additionally, it shows how to implement middleware for verifying user sessions and roles, and how to handle user logout securely. 109 7. 7 [](/posts/authentication-vs-authorization-4q36dzcbu "Authentication vs Authorization") Article Cerbos · 2y Authentication vs Authorization Understanding authentication and authorization is key to securing applications. Authentication verifies user identity, while authorization determines what authenticated users are allowed to do. Authentication methods include passwords and biometrics, whereas authorization relies on access control lists and roles. Effective authorization systems need to be scalable and flexible. Services like Cerbos offer robust, scalable solutions that enhance security by ensuring only permitted users access sensitive data. 105 8 8. 8 [](/posts/stop-recommending-jwts-with-symmetric-keys-truffle-security-co--fnr398fxt "Stop Recommending JWTs (with symmetric keys) ◆ Truffle Security Co.") Article Community Picks · 2y Stop Recommending JWTs (with symmetric keys) ◆ Truffle Security Co. This post discusses the issues with using symmetric key JWTs, including the high percentage of guessable keys and the risk of undermining authentication and authorization security. 104 12 9. 9 [](/posts/better-auth-better-auth-the-most-comprehensive-authentication-library-for-typescript-vh6m9zyjj "better-auth/better-auth: The most comprehensive authentication library for TypeScript") Article Community Picks · 2y better-auth/better-auth: The most comprehensive authentication library for TypeScript Better Auth is a comprehensive, framework-agnostic authentication and authorization library for TypeScript. It aims to reduce the need for extensive additional code by offering a rich set of features out of the box, while prioritizing best practices and type safety. Currently in beta, the project focuses on simplicity, consistency, and predictability across different platforms. It supports plugins for advanced functionalities like 2FA and multi-tenant support, and is licensed under the MIT License. 90 3 10. 10 [](/posts/permissions-authorization-in-a-next-js-full-stack-project-nlgrxp8og "Permissions & Authorization in a Next.js Full Stack Project") Video Dave Gray · 2y Permissions & Authorization in a Next.js Full Stack Project Dave provides a lesson on applying permissions in a Next.js full stack application. He explains how to set up permissions for users, employees, managers, and admins, emphasizing the importance of restricting access based on roles. The tutorial includes integration with Sentry for error reporting and performance monitoring. Detailed walkthroughs guide users through installing required packages, setting up Kind for user management, and configuring permissions using Kind's management API. The tutorial also addresses compatibility issues with using Next.js 15 and React 19. 88 11. 11 [](/posts/how-to-build-a-request-access-approval-system-using-next-js-ataqwd0zt "How to Build a Request Access Approval System using Next.js") Article Community Picks · 2y How to Build a Request Access Approval System using Next.js Next.js is a robust React framework for building web applications. Creating a Request Access Approval (RAA) System is essential for managing access to sensitive data within organizations. By using Permit.io, Next.js applications can handle complex access requests and manage approvals efficiently. The guide walks through setting up a Next.js project, integrating Permit.io for authorization, and implementing user management and access request components to safeguard critical information. 87 3 12. 12 [](/posts/3-most-common-authorization-designs-for-saas-products-qshfhfz5n "3 Most Common Authorization Designs for SaaS Products") Article Cerbos · 2y 3 Most Common Authorization Designs for SaaS Products Authorization is essential for securing SaaS applications, ensuring only authorized users access specific resources. This post details three common authorization models: Access Control List (ACL), Role-Based Access Control (RBAC), and Attribute-Based Access Control (ABAC). ACL is simple and quick but may require manual updates as the system scales. RBAC is more scalable, using roles to grant permissions, but can suffer from 'role explosion' as granular control increases. ABAC is the most complex and powerful, using contextual information and attributes to manage access dynamically. Organizations with complex needs might consider third-party solutions like Cerbos for easier implementation. 84 8 13. 13 [](/posts/building-secure-private-screens-in-react-vqzvtjigq "Building Secure Private Screens in React") Article Community Picks · 2y Building Secure Private Screens in React Modern applications often require fine-grained access control for private or restricted pages, documents, or features. Permit.io simplifies this by providing embeddable UI components for access sharing. This guide outlines the integration of Permit.io's Access Request Element into a React application, allowing users to request access to restricted resources, with admins being able to approve or deny these requests. The article also covers the necessary setup for authentication, the creation of backend routes, and the embedding of iframe components in a React app. 70 14. 14 [](/posts/please-stop-using-middleware-to-protect-your-routes-cn1uvirtg "Please stop using middleware to protect your routes") Article Community Picks · 3y Please stop using middleware to protect your routes The post discusses the use of middleware for route protection and argues against its usage. It highlights the drawbacks of using middleware for authorization and suggests alternative approaches for implementing route protection based on user roles. 63 10 15. 15 [](/posts/a-complete-guide-to-next-js-authorization-kum2ajvst "A Complete Guide to Next.js Authorization") Article Cerbos · 2y A Complete Guide to Next.js Authorization Learn about authorization in Next.js using Cerbos, an open-source authorization project. Understand how authorization works, how to integrate it into a Next.js application, and implement attribute-based access control (ABAC) and role-based access control (RBAC). 60 8 16. 16 [](/posts/complete-guide-to-building-authorization-systems-using-rbac-rebac-and-abac-zfmsrbtey "Complete Guide to Building Authorization Systems using RBAC, ReBAC and ABAC") Article gitconnected · 2y Complete Guide to Building Authorization Systems using RBAC, ReBAC and ABAC Building a robust and scalable authorization system requires understanding various models like Role-Based Access Control (RBAC), Relationship-Based Access Control (ReBAC), and Attribute-Based Access Control (ABAC). Using examples from GitHub, the post explains the complexities of managing permissions and dynamically updating them in real time. It covers how OpenFGA can be used to model these relationships declaratively for ReBAC and briefly introduces ABAC for attribute-driven access control. 53 17. 17 [](/posts/why-low-latency-is-important-in-authorization-fibhks8jk "Why low latency is important in authorization") Article Cerbos · 2y Why low latency is important in authorization Fast authorization checks are critical for ensuring smooth user experiences across applications. High latency can lead to user frustration, system performance issues, and increased costs. Solutions like Cerbos offer innovative approaches to mitigate latency, including running authorization checks close to the application, utilizing stateless systems, and optimizing policy management. These practices improve scalability and reliability, crucial for sectors like e-commerce, fintech, and streaming services. 44 18. 18 [](/posts/how-to-learn-kubernetes-complete-roadmap-resources--rydslyxaj "How to Learn Kubernetes (Complete Roadmap & Resources)") Article Community Picks · 2y How to Learn Kubernetes (Complete Roadmap & Resources) Learn about the prerequisites, architecture, setting up a cluster, pods and associated resources, securing a cluster, configuration management, the operator pattern, deploying microservices, online resources, and real-world case studies for Kubernetes. 44 1 19. 19 [](/posts/implement-authorization-and-access-control-in-an-express-application-ao9otilwo "Implement authorization and access control in an Express application") Article Cerbos · 2y Implement authorization and access control in an Express application Learn how to implement role-based access control (RBAC) in an Express application using Cerbos PDP. This guide covers necessary installations, setting up a project, defining roles and permissions through policy files, and configuring routes to enforce RBAC. The example uses a learning management system to demonstrate the process. 43 8 20. 20 [](/posts/what-is-dynamic-authorization-and-why-is-it-important--5zker0qmx "What is dynamic authorization and why is it important?") Article Cerbos · 2y What is dynamic authorization and why is it important? Dynamic authorization controls access in real-time, adapting permissions based on context, which is ideal for complex, modern systems like microservices. Unlike static methods, it evaluates factors like user role, location, and device type to ensure secure and flexible access. This approach enhances security, scalability, and regulatory compliance, as seen in industries such as healthcare and finance. Solutions like Cerbos facilitate the implementation and management of dynamic authorization, strengthening overall security and adaptability. 40 1 21. 21 [](/posts/access-control-for-rag-and-llms---live-demo-matwxch1d "Access control for RAG and LLMs - live demo") Article Cerbos · 2y Access control for RAG and LLMs - live demo As more businesses adopt Retrieval Augmented Generation (RAG) models to enhance their AI systems, managing access control becomes crucial. The live demo by Alex Olivier illustrated how Cerbos PDP can implement authorization in RAG architectures. Key challenges include unauthorized data exposure and the need for dynamic data access. Cerbos provides context-aware authorization decisions, safeguarding sensitive data and ensuring compliance. 39 22. 22 [](/posts/what-is-spring-security-for-real--80yt7ilwl "what is Spring Security for real 🤔") Article Just Java · 2y what is Spring Security for real 🤔 Spring Security is a powerful framework for securing Java applications, handling authentication and authorization. It protects against vulnerabilities like CSRF and XSS, offers customizable security policies, and integrates seamlessly with other Spring projects. Features include security context propagation, custom authentication providers, method-level security, and configuring security headers for enhanced protection. A real-world example shows how to secure a RESTful API with role-based access. 39 23. 23 [](/posts/oauth-vs-jwt-differences-in-application-authentication-and-authorization-rndmqad5j "OAuth vs. JWT: Differences in Application Authentication and Authorization") Article Permit.io · 3y OAuth vs. JWT: Differences in Application Authentication and Authorization Explore the differences between OAuth and JWT in web app security and their importance in modern web development. 36 24. 24 [](/posts/modeling-authorization-in-prisma---no-theory-just-code-vktwavuqz "Modeling Authorization in Prisma - No Theory, Just Code") Article DEV · 3y Modeling Authorization in Prisma - No Theory, Just Code This post provides examples of different authorization patterns using Prisma and ZenStack. It covers the Access Control List (ACL), Role-Based Access Control (RBAC), Attribute-Based Access Control (ABAC), and multi-tenancy patterns. The examples show how to implement these patterns and highlight the benefits of using ZenStack for declarative authorization rules. 36 25. 25 [](/posts/microservices-authorization-yyinkkisg "Microservices Authorization") Article Pointer · 3y Microservices Authorization Learn about the complexities of implementing authorization in microservices through the example of GitClub Jobs. 35 [See all Authorization archives](/tags/authorization/best-of) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@graph":[{"@type":"CollectionPage","@id":"https://daily.dev/tags/authorization/best-of/2024#page","url":"https://daily.dev/tags/authorization/best-of/2024","name":"Best Authorization Posts of 2024","description":"The most upvoted Authorization posts of 2024, curated by the daily.dev community.","isPartOf":{"@type":"WebSite","url":"https://daily.dev"}},{"@type":"ItemList","@id":"https://daily.dev/tags/authorization/best-of/2024#items","numberOfItems":25,"itemListElement":[{"@type":"ListItem","position":1,"url":"https://daily.dev/posts/oauth-2-0-flows-explained-in-gifs-beqiosycs","name":"🔑 OAuth 2.0 flows explained in GIFs"},{"@type":"ListItem","position":2,"url":"https://daily.dev/posts/how-linkedin-authorizes-10-million-api-calls-per-second-qccaxvvwq","name":"How LinkedIn Authorizes 10 Million API Calls Per Second"},{"@type":"ListItem","position":3,"url":"https://daily.dev/posts/permify-permify-an-open-source-authorization-as-a-service-inspired-by-google-zanzibar-designed-to--wjstrkasl","name":"Permify/permify: An open-source authorization as a service inspired by Google Zanzibar, designed to build and manage fine-grained and scalable authorization systems for any application."},{"@type":"ListItem","position":4,"url":"https://daily.dev/posts/how-to-use-reactjs-for-secure-role-based-access-control-jrdd1jag0","name":"How to use ReactJS for secure Role Based Access Control"},{"@type":"ListItem","position":5,"url":"https://daily.dev/posts/microservices-authentication-and-authorization-using-api-gateway-3ozhaevfd","name":"Microservices Authentication and Authorization Using API Gateway"},{"@type":"ListItem","position":6,"url":"https://daily.dev/posts/build-a-login-and-logout-api-using-express-js-node-js--b1mx368cl","name":"Build a Login and Logout API using Express.js (Node.js)"},{"@type":"ListItem","position":7,"url":"https://daily.dev/posts/authentication-vs-authorization-4q36dzcbu","name":"Authentication vs Authorization"},{"@type":"ListItem","position":8,"url":"https://daily.dev/posts/stop-recommending-jwts-with-symmetric-keys-truffle-security-co--fnr398fxt","name":"Stop Recommending JWTs (with symmetric keys) ◆ Truffle Security Co."},{"@type":"ListItem","position":9,"url":"https://daily.dev/posts/better-auth-better-auth-the-most-comprehensive-authentication-library-for-typescript-vh6m9zyjj","name":"better-auth/better-auth: The most comprehensive authentication library for TypeScript"},{"@type":"ListItem","position":10,"url":"https://daily.dev/posts/permissions-authorization-in-a-next-js-full-stack-project-nlgrxp8og","name":"Permissions & Authorization in a Next.js Full Stack Project"},{"@type":"ListItem","position":11,"url":"https://daily.dev/posts/how-to-build-a-request-access-approval-system-using-next-js-ataqwd0zt","name":"How to Build a Request Access Approval System using Next.js"},{"@type":"ListItem","position":12,"url":"https://daily.dev/posts/3-most-common-authorization-designs-for-saas-products-qshfhfz5n","name":"3 Most Common Authorization Designs for SaaS Products"},{"@type":"ListItem","position":13,"url":"https://daily.dev/posts/building-secure-private-screens-in-react-vqzvtjigq","name":"Building Secure Private Screens in React"},{"@type":"ListItem","position":14,"url":"https://daily.dev/posts/please-stop-using-middleware-to-protect-your-routes-cn1uvirtg","name":"Please stop using middleware to protect your routes"},{"@type":"ListItem","position":15,"url":"https://daily.dev/posts/a-complete-guide-to-next-js-authorization-kum2ajvst","name":"A Complete Guide to Next.js Authorization"},{"@type":"ListItem","position":16,"url":"https://daily.dev/posts/complete-guide-to-building-authorization-systems-using-rbac-rebac-and-abac-zfmsrbtey","name":"Complete Guide to Building Authorization Systems using RBAC, ReBAC and ABAC"},{"@type":"ListItem","position":17,"url":"https://daily.dev/posts/why-low-latency-is-important-in-authorization-fibhks8jk","name":"Why low latency is important in authorization"},{"@type":"ListItem","position":18,"url":"https://daily.dev/posts/how-to-learn-kubernetes-complete-roadmap-resources--rydslyxaj","name":"How to Learn Kubernetes (Complete Roadmap & Resources)"},{"@type":"ListItem","position":19,"url":"https://daily.dev/posts/implement-authorization-and-access-control-in-an-express-application-ao9otilwo","name":"Implement authorization and access control in an Express application"},{"@type":"ListItem","position":20,"url":"https://daily.dev/posts/what-is-dynamic-authorization-and-why-is-it-important--5zker0qmx","name":"What is dynamic authorization and why is it important?"},{"@type":"ListItem","position":21,"url":"https://daily.dev/posts/access-control-for-rag-and-llms---live-demo-matwxch1d","name":"Access control for RAG and LLMs - live demo"},{"@type":"ListItem","position":22,"url":"https://daily.dev/posts/what-is-spring-security-for-real--80yt7ilwl","name":"what is Spring Security for real 🤔"},{"@type":"ListItem","position":23,"url":"https://daily.dev/posts/oauth-vs-jwt-differences-in-application-authentication-and-authorization-rndmqad5j","name":"OAuth vs. JWT: Differences in Application Authentication and Authorization"},{"@type":"ListItem","position":24,"url":"https://daily.dev/posts/modeling-authorization-in-prisma---no-theory-just-code-vktwavuqz","name":"Modeling Authorization in Prisma - No Theory, Just Code"},{"@type":"ListItem","position":25,"url":"https://daily.dev/posts/microservices-authorization-yyinkkisg","name":"Microservices Authorization"}]},{"@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Tags","item":"https://daily.dev/tags"},{"@type":"ListItem","position":3,"name":"Authorization","item":"https://daily.dev/tags/authorization"},{"@type":"ListItem","position":4,"name":"Best of","item":"https://daily.dev/tags/authorization/best-of"},{"@type":"ListItem","position":5,"name":"2024"}]}]} ```