Building Authorization with Node.js: Dos and Don’ts
summary
Shows a concrete authorization microservice built with Opal and the Cedar policy language, using an Opal client as a sidecar decision agent that accepts principal action and resource and returns allow/deny. Demo uses a Node.js blog and a Python app sharing the same service, with policy-as-code stored in git so a commit changes enforcement in seconds (example: writers need >=1000 karma to publish). Covers audit logs, HTTP agent calls, and a commercial UI option with Permit.io.
AI-written summary · about
chapters (28)
- 0:00intro
- 0:22preamble
- 0:46find the difference
- 4:01authentication advanced features
- 5:44about gabriel
- 6:38innovations
- 12:12staging & production
- 13:05express & flask
- 13:55authorization best practices
- 15:44model
- 18:48acl - access control list
- 19:45rbac - role based access control
- 21:06abac - attribute based access control
- 22:25rebac - relationship based access control
- 23:36author
- 23:46contracts create better relationships
- 25:47cedar
- 27:40generate code from ui
- 28:21analyze: cedar agent
- 29:01enforce authorization policies
- 30:22casl - frontend feature toggling sdk
- 30:46audit
- 31:04authorization system building blocks
- 31:40opal - open policy administration layer
- 32:19opal based authorization architecture
- 33:40demo
- 42:00about permit.io
- 42:25thank you
related talks
43mApplication Code of Conduct - Full-Stack Policy as Code
45mNext Generation Authorisation using Cedar
27mSecurity-by-construction: How to weave authorization into modern app stacks using Open Policy Agent
45mThe Future of Authorization in Applications
49mLove, Hate, And Policy Languages
42mBeyond Code: Shaping Security in a Developer-Driven World
20mCedar: A New Language for Expressive, Fast, Safe, and Analyzable Authorization
26mAuthorization in a Service-Oriented Environment