Auth By Example - DEV Community

Auth By Example

Oct 8

What EU AI Act Article 12 and ISO 42001 mean for AI agent logs

#ai #security #compliance #authorization

2 min read

Auth By Example

Oct 8

GraphQL resolvers often check the top-level object and skip the nested ones

#graphql #authorization #security #api

2

1 min read

Auth By Example

Oct 7

The user picker in your share dialog can leak your whole user table

#security #webdev #api #backend

1 min read

Auth By Example

Oct 7

An admin shouldn't be able to grant a role bigger than their own

#authorization #security #api #webdev

1 min read

Auth By Example

Oct 7

Archiving a workspace should make the API read-only too

#security #api #webdev #saas

1 min read

Auth By Example

Oct 6

Four questions to ask about one real authorization flow

#webdev #saas #security #authorization

1 min read

Auth By Example

Oct 6

Duplicating a record should check access to everything it copies

#security #api #webdev #backend

1 min read

Auth By Example

Oct 6

Attachment downloads should check the record they belong to

#security #api #webdev #backend

1 min read

Auth By Example

Oct 6

Counts and totals need the same authorization filter as the list

#security #api #webdev #backend

2

1 min read

Auth By Example

Oct 5

A valid token is not an AI agent audit trail

#security #ai #authorization #compliance

1 min read

Auth By Example

Oct 5

An email domain is not tenant membership

#security #webdev #saas #backend

2 min read

Auth By Example

Oct 5

A presigned URL is not ongoing authorization

#security #webdev #api #aws

2 min read

Auth By Example

Oct 4

An MFA challenge pass is not object authorization

#authentication #cybersecurity #infosec #security

1 min read

Auth By Example

Oct 4

A CORS allowlist is not authorization

#security

1 min read

Auth By Example

Oct 4

A signed cookie is not object authorization

#security #backend #javascript

1 min read

Auth By Example

Oct 3

A reverse-proxy auth plugin is not application authorization

#security #backend #api #webdev

1 min read

Auth By Example

Oct 3

A shared service account is not per-tenant authorization

#security #backend #api #webdev

1 min read

Auth By Example

Oct 3

A system cron job still needs per-tenant authorization

#security #backend #api #webdev

1

5

1 min read

Auth By Example

Oct 2

Stop picking an authorization religion

#abac

1 min read

Auth By Example

Oct 2

Tool traces are not an AI agent audit trail

#ai

1 min read

Auth By Example

Oct 2

A bulk export still needs per-row authorization

#api #backend #cybersecurity #security

1 min read

Auth By Example

Oct 2

An alternate-key lookup still needs object authorization

#security #backend #api #webdev

1 min read

Auth By Example

Oct 1

IdP login logs cannot answer "why was this allowed?"

#devops

1 min read

Auth By Example

Oct 1

A client-supplied tenant id is not authorization

#webdev

2

1 min read

Auth By Example

Oct 1

SOC 2 CC6 and ISO 27001 still assume humans — agents break the evidence model

#devops

1 min read

Auth By Example

Oct 1

A nested resource path still needs two authorization checks

#webdev

1 min read

Auth By Example

Oct 1

A long-lived stream is not a standing permission grant

#security #backend #api #webdev

1

1 min read

Auth By Example

Sep 30

IdP login logs are not enough for SOC 2-style access reviews

#devops

1 min read

Auth By Example

Sep 30

An async job is not a free pass on authorization

#security #backend #api #webdev

1 min read

Auth By Example

Sep 30

Login events are not authorization evidence

#security #iam #architecture

1 min read

Auth By Example

Sep 30

A batch API is not a free pass on every item

#security #api #backend #webdev

1 min read

Auth By Example

Sep 30

A WebSocket reconnect is not a free pass

#security #websocket #api #backend

2

1

1 min read

Auth By Example

Sep 29

What least-privilege evidence your authz model can actually produce

#security #permitchallenge #devops

1

3

1 min read

Auth By Example

Sep 29

A valid webhook signature is not authorization

#security #api #webdev #webhooks

2

1 min read

Auth By Example

Sep 29

Feature Flags Are Not Authorization

#security #api #webdev #devops

2 min read

Auth By Example

Sep 29

When every exception becomes a new role, you need attributes

#security #api #webdev #cybersecurity

1 min read

Auth By Example

Sep 28

AI agents that inherit your OAuth token break least privilege

#authorization #ai #security #oauth

1

1 min read

Auth By Example

Sep 28

A share link is a scoped grant, not permanent access

#security #api #webdev #cybersecurity

1 min read

Auth By Example

Sep 28

Search results still need authorization filters

#security #api #webdev #cybersecurity

1 min read

Auth By Example

Sep 27

A list endpoint must filter by authorization

#backend

1 min read

Auth By Example

Sep 27

Email verified is not authorization

#security #api #webdev #cybersecurity

1

1 min read

Auth By Example

Sep 27

Rate limiting is not authorization

#security #api #webdev #cybersecurity

1 min read

Auth By Example

Sep 26

WebSocket subscribe is still authorization

#security #api #webdev #cybersecurity

1

1 min read

Auth By Example

Sep 26

MFA is not authorization

#security #api #webdev #cybersecurity

1 min read

Auth By Example

Sep 26

CORS is not authorization

#security #api #webdev #cybersecurity

1

1 min read

Auth By Example

Sep 25

Background jobs still need the caller's authorization

#security #api #webdev #permissions

1 min read

Auth By Example

Sep 25

OAuth scopes are not object permissions

#security #api #webdev #permissions

1 min read

Auth By Example

Sep 25

Frontend visibility is not authorization

#security #api #webdev #permissions

1 min read

Auth By Example

Sep 24

Service identity is not user permission

#security #api #backend

1 min read

Auth By Example

Sep 24

A tenant claim is not tenant isolation

#security #api #webdev #permissions

1 min read

Auth By Example

Sep 24

OAuth on MCP is not the same as authorizing each tool call

#security #mcp #api #authorization

1 min read

Auth By Example

Sep 24

Project access is not object permission

#security #api #webdev #permissions

1 min read

Auth By Example

Sep 24

A stale authorization cache is not a current permission

#security #api #webdev #permissions

1 min read

Auth By Example

Sep 23

Feature flags are not authorization

#security #api #permissions #webdev

1 min read

Auth By Example

Sep 23

Tenant membership is not resource permission

#security #api #webdev #permissions

1 min read

Auth By Example

Sep 23

Read permission is not export permission

#security #authorization #api #webdev

1 min read

Auth By Example

Sep 22

Page 2 of a list still needs the same authorization filter

#security #api #beginners

4

1 min read

Auth By Example

Sep 22

mTLS proves which service called you — not what it may do

#security #api #beginners

1 min read

Auth By Example

Sep 22

OAuth scopes are not your app's authorization model

#oauth #security #webdev #beginners

1

1 min read

Auth By Example

Sep 21

Creating a child resource still needs a check on the parent

#security #webdev #api

1 min read

1 Week Community Wellness Streak

Writing Debut

Want to connect with Auth By Example?