Auth By Example - DEV Community

Auth By Example

Oct 14

A new group with an old group's name can inherit everything the old one could access

#authorization #security #backend #saas

1

1 min read

Auth By Example

Oct 14

What to log when an AI agent acts on someone's behalf

#ai #security #authorization #mcp

2

2 min read

Auth By Example

Oct 14

A profile update endpoint can let users change fields they were never allowed to edit

#authorization #security #backend #api

2 min read

Auth By Example

Oct 14

An approve button needs to check that the approver didn't file the request

#authorization #security #backend #webdev

1 min read

Auth By Example

Oct 13

When an invoice approval check outgrows if user.role == "admin"

#authorization #security #architecture #webdev

2 min read

Auth By Example

Oct 13

A CSV import that matches on ID can overwrite records the importer can't edit

#authorization #security #backend #saas

2 min read

Auth By Example

Oct 13

Before an agent's tool call runs, the check needs to know who delegated it

#ai #security #authorization #mcp

1

3

2 min read

Auth By Example

Oct 13

Sorting by a hidden column can leak the values you hid

#authorization #security #backend #saas

1 min read

Auth By Example

Oct 13

Renaming a shared tag can edit records the user can't open

#authorization #security #backend #saas

1 min read

Auth By Example

Oct 12

Reply-by-email can post comments after the sender loses access

#webdev #authorization #security #backend

1 min read

Auth By Example

Oct 12

An open editor tab can keep autosaving after you remove edit access

#authorization #security #backend #webdev

1

1 min read

Auth By Example

Oct 12

Search autocomplete can name records the list page already hid

#saas #authorization #backend #security

1 min read

Auth By Example

Oct 11

Your related items panel can name records the viewer can't open

#authorization #security #backend #saas

1 min read

Auth By Example

Oct 11

Your command palette can list records the search page would hide

#authorization #security #backend #saas

1 min read

Auth By Example

Oct 11

Print preview can still show records the user lost access to

#authorization #security #backend #saas

1 min read

Auth By Example

Oct 10

Your CSV export can include rows the list already hid

#authorization #security #backend #saas

1 min read

Auth By Example

Oct 10

Your daily email digest can name records the user can't open

#security #backend #saas #authorization

1 min read

Auth By Example

Oct 10

Your notification bell can show titles the user can't open

#authorization #security #backend #saas

1

1 min read

Auth By Example

Oct 9

Full-text search can return hits your list page would hide

#saas #authorization #security #backend

1 min read

Auth By Example

Oct 9

ISO 42001 certification is an audit of your AI management system, not a badge from ISO

#ai #security #compliance #iso42001

1 min read

Auth By Example

Oct 9

A batch get-by-id endpoint can leak records your list filter would hide

#authorization #security #backend #saas

1 min read

Auth By Example

Oct 9

A report that joins tables can leak rows your list pages would hide

#authorization #security #backend #saas

1 min read

Auth By Example

Oct 8

What EU AI Act Article 12 and ISO 42001 mean for AI agent logs

#ai #security #compliance #authorization

2 min read

Auth By Example

Oct 8

GraphQL resolvers often check the top-level object and skip the nested ones

#graphql #authorization #security #api

2

1 min read

Auth By Example

Oct 7

The user picker in your share dialog can leak your whole user table

#security #webdev #api #backend

1 min read

Auth By Example

Oct 7

An admin shouldn't be able to grant a role bigger than their own

#authorization #security #api #webdev

1 min read

Auth By Example

Oct 7

Archiving a workspace should make the API read-only too

#security #api #webdev #saas

1 min read

Auth By Example

Oct 6

Four questions to ask about one real authorization flow

#webdev #saas #security #authorization

1 min read

Auth By Example

Oct 6

Duplicating a record should check access to everything it copies

#security #api #webdev #backend

1 min read

Auth By Example

Oct 6

Attachment downloads should check the record they belong to

#security #api #webdev #backend

1 min read

Auth By Example

Oct 6

Counts and totals need the same authorization filter as the list

#security #api #webdev #backend

3

1 min read

Auth By Example

Oct 5

A valid token is not an AI agent audit trail

#security #ai #authorization #compliance

1 min read

Auth By Example

Oct 5

An email domain is not tenant membership

#security #webdev #saas #backend

2 min read

Auth By Example

Oct 5

A presigned URL is not ongoing authorization

#security #webdev #api #aws

2 min read

Auth By Example

Oct 4

An MFA challenge pass is not object authorization

#authentication #cybersecurity #infosec #security

1 min read

Auth By Example

Oct 4

A CORS allowlist is not authorization

#security

1 min read

Auth By Example

Oct 4

A signed cookie is not object authorization

#security #backend #javascript

1 min read

Auth By Example

Oct 3

A reverse-proxy auth plugin is not application authorization

#security #backend #api #webdev

1 min read

Auth By Example

Oct 3

A shared service account is not per-tenant authorization

#security #backend #api #webdev

1 min read

Auth By Example

Oct 3

A system cron job still needs per-tenant authorization

#security #backend #api #webdev

1

7

1 min read

Auth By Example

Oct 2

Stop picking an authorization religion

#abac

1 min read

Auth By Example

Oct 2

Tool traces are not an AI agent audit trail

#ai

1 min read

Auth By Example

Oct 2

A bulk export still needs per-row authorization

#api #backend #cybersecurity #security

1 min read

Auth By Example

Oct 2

An alternate-key lookup still needs object authorization

#security #backend #api #webdev

1 min read

Auth By Example

Oct 1

IdP login logs cannot answer "why was this allowed?"

#devops

1 min read

Auth By Example

Oct 1

A client-supplied tenant id is not authorization

#webdev

2

1 min read

Auth By Example

Oct 1

SOC 2 CC6 and ISO 27001 still assume humans — agents break the evidence model

#devops

1 min read

Auth By Example

Oct 1

A nested resource path still needs two authorization checks

#webdev

1 min read

Auth By Example

Oct 1

A long-lived stream is not a standing permission grant

#security #backend #api #webdev

1

1 min read

Auth By Example

Sep 30

IdP login logs are not enough for SOC 2-style access reviews

#devops

1 min read

Auth By Example

Sep 30

An async job is not a free pass on authorization

#security #backend #api #webdev

1 min read

Auth By Example

Sep 30

Login events are not authorization evidence

#security #iam #architecture

1 min read

Auth By Example

Sep 30

A batch API is not a free pass on every item

#security #api #backend #webdev

1 min read

Auth By Example

Sep 30

A WebSocket reconnect is not a free pass

#security #websocket #api #backend

2

3

1 min read

Auth By Example

Sep 29

What least-privilege evidence your authz model can actually produce

#security #permitchallenge #devops

1

3

1 min read

Auth By Example

Sep 29

A valid webhook signature is not authorization

#security #api #webdev #webhooks

2

1 min read

Auth By Example

Sep 29

Feature Flags Are Not Authorization

#security #api #webdev #devops

2 min read

Auth By Example

Sep 29

When every exception becomes a new role, you need attributes

#security #api #webdev #cybersecurity

1 min read

Auth By Example

Sep 28

AI agents that inherit your OAuth token break least privilege

#authorization #ai #security #oauth

1

1 min read

Auth By Example

Sep 28

A share link is a scoped grant, not permanent access

#security #api #webdev #cybersecurity

1 min read

2 Week Community Wellness Streak

1 Week Community Wellness Streak

Writing Debut

Want to connect with Auth By Example?