HeimGuard VS frank_jwt

Here’s a small lib I made to make feature access easier. Business logic is usually more baked in. You could have somewhat more merged if those two with resource based FGA using OpenFGA or Permify too but don’t cross that bridge unless you need it.

I’m usually able to get away with permission based access, but am looking into resource based for a current project.

There are a few libraries that try and solve this problem in the ASP.NET platform level. The ones I know are https://github.com/pdevito3/HeimGuard and https://www.thereformedprogrammer.net/finally-a-library-that-improves-role-authorization-in-asp-net-core/

If anyone’s interested, I feel dove this a while back and put together a small lib for this to make permission checking a bit smoother. Depending on how your tenanting works OP, it would likely fit into this fairly well.

As far as authorization, the link above uses a project called HiemGuard to protect the endpoints.

I looked into simplifying this a lot a few weeks ago and ended up putting together a small helper library to make my life easier around permissions if you want to check it out. Should be able to integrate into your authentication setup just fine.

NOTE: Never store sensitive information about a client in the payload as the JWT is just encoded and not encrypted. You can paste the JWT I gave as an example above in this cool site which basically allows you to see in decoded. JSON Web Tokens - jwt.io

Although they did not make it into production, I experimented with the RabbitMQ message broker, Python (Django, Flask), Kubernetes + minikube, JWT, and NGINX. This was a hobby project, but I intended to learn about microservices along the way.

JSON Web Token (JWT) creation to extend user authentication to server-side functions

The (probably) most famous web resource about JWT - https://jwt.io - provides such a definition of JSON Web Tokens:

If you want to play with JWT and put these concepts into practice, you can use jwt.ioDebugger to decode, verify, and generate JWTs.

In this context, JSON Web Tokens (JWTs) play a crucial role.

Json Web Token (JWT): Even though it is more like an industry standard, we will use JWTs for stateless authentication in this article. If you want to learn more, you can refer to the official documentation.

Se pegar o token jwt podemos ver o que tem dentro, usando o site jwt.io.