Renaming a shared tag can edit records the user can't open
Tags and labels are often stored once per workspace and joined to records through a tag_id. The rename endpoint checks that the caller can manage ta…
Latest Web news from Tech News
All topics
AI
agents
ai
api
architecture
automation
backend
beginners
career
database
devchallenge
devops
discuss
javascript
linux
llm
machinelearning
mcp
opensource
performance
productivity
programming
python
react
security
showdev
testing
tutorial
typescript
webdev
What EU AI Act Article 12 and ISO 42001 mean for AI agent logs
Article 12 of the EU AI Act says high-risk AI systems must technically allow automatic recording of events (logs) over the lifetime of the system. I…
Role-Based and Permission-Based Access Control in Spring Security
Introduction Once authentication is solid, the next question is inevitable: what is this user actually allowed to do? Authentication proves who you…
Authorization at the Object Level: Testing for BOLA Before Someone Else Does
Authorization at the Object Level: Testing for BOLA Before Someone Else Does Broken object level authorization is consistently at the top of the OWA…
API Security: The Attack Surface That Grows Without a Firewall
API Security: The Attack Surface That Grows Without a Firewall Every new application feature tends to arrive as an API endpoint. Mobile clients, par…
Pull the tenant from the auth context, not the request body
In multi-tenant apps, a common bug is reading tenant_id from the JSON body or query string and then authorizing against that value. Anyone can send…
I Made Four Authorization Engines Answer the Same Questions
"Which authorization engine should I use" always gets answered with a table. Cedar is analyzable, Rego is expressive, Zanzibar is relationship-based…
The Life of a Permission Check: Following One Request Through 14 Layers of Authorization
TL;DR: What actually happens when a user clicks "Delete" in your Laravel app? Most developers think it's a single boolean check. In reality, a moder…
Trusted AI Agent Transactions, Part 4: PingAuthorize Policy Decisions
Making policy decisions with PingAuthorize Part 3 established the transaction context and immediate caller identity. Authorization still needs to an…
🚨 10 Authorization Anti-Patterns I Keep Finding in Laravel Apps (And the One-Line Fixes That Save Them)
TL;DR: After reviewing hundreds of Laravel codebases, the same 10 authorization mistakes show up again and again. This article walks through each an…
5 Laravel Authorization Problems You're Probably Facing (And How to Solve Them in 2026)
TL;DR: Most Laravel apps hit the same 5 authorization walls as they grow — role explosion, exception handling, multi-tenancy, contextual permissions…
ReBAC isn't the problem. The ReBAC tools I tried are.
ReBAC (relationship-based access control) decides access based on how entities are connected to each other, rather than on a role attached to the us…
RBAC and Policy-Based Authorization: Controlling Access by Role and Rule
RBAC and Policy-Based Authorization: Controlling Access by Role and Rule A practical guide to authorization models — Role-Based Access Control (RBAC…
Как защитить Manticore Search с помощью встроенной аутентификации и авторизации
Поиск нередко считают просто инфраструктурой. Но в продакшене он фактически работает как API приложения: принимает пользовательский т…
SecretAuth – UX-решение для авторизации посредством приватного ключа
Мир сильно изменился с начала 21 века. В том числе, что касается систем авторизации. Мы продвинулись от авторизации через обычный логин и пароль к и…
SaaS Security Best Practices: Auth, Authorization, and Data Protection
Security is not a feature — it is a property of your entire architecture. This guide covers the security practices implemented in production SaaS ap…
Implement Authorization with Role-Based Access Control (RBAC) in Golang
This is part 2 of our authentication and authorization series. In the previous part, we implemented an authentication system from scratch in Golang…
A Deactivated Admin Could Still Use Their Token. That's When Dual-Mode JWT Stopped Being About Speed.
What building cross-service RBAC taught me about the difference between a fast check and a correct one VaultPay is a wallet microservice I built on…
Supabase Authentication & Authorization Patterns
Supabase Authentication & Authorization Patterns Authentication and authorization are the foundation of secure applications. Supabase provides a…
Building Dynamic RBAC in React 19: From Permission Strings to Component-Level Access Control
Building Dynamic RBAC in React 19: From Permission Strings to Component-Level Access Control String-based permission checks scattered across your Re…
Introducing Zopa: a 60 KB authorization engine for proxy-wasm, written in Zig
There are plenty of times you want to delegate "let this request through, or block it" to a wasm filter inside Envoy. API gateways, service mesh bou…
Authorization at Scale: Access Levels, Roles, and Compact Decisions
Authentication answers "who are you?" Authorization answers the harder question: "are you allowed to do this?" By the time a request reaches this st…