Auth By Example

Practical lessons on auth, authorization, and access control.

Joined on Sep 17, 2026 https://www.permit.io

Auth By Example

Sep 22

mTLS proves which service called you — not what it may do

#security #api #beginners

1 min read

Auth By Example

Sep 22

OAuth scopes are not your app's authorization model

#oauth #security #webdev #beginners

1 min read

Auth By Example

Sep 21

Creating a child resource still needs a check on the parent

#security #webdev #api

1 min read

Auth By Example

Sep 21

Frontend route guards are not authorization

#security #webdev #beginners

1 min read

Auth By Example

Sep 21

Feature flags are not access control

#security #webdev #beginners

1 min read

Auth By Example

Sep 20

An internal network is not a permission

#security #webdev #beginners

1 min read

Auth By Example

Sep 20

Batch APIs still need per-item authorization

#security #api #webdev

1 min read

Auth By Example

Sep 19

Validate the JWT audience claim

#security #webdev #beginners #authentication

1 min read

Auth By Example

Sep 19

Pull the tenant from the auth context, not the request body

#security #webdev #beginners #authorization

1 min read

Auth By Example

Sep 19

Authorize the object, not just the route

#security #webdev #beginners #authorization

1 min read

Auth By Example

Sep 18

Separate who can grant from who can act

#security #webdev #beginners

1 min read

Auth By Example

Sep 18

Never trust a client-supplied tenant ID

#security #webdev #beginners #authorization

1 min read

Auth By Example

Sep 18

Check permissions again after every trust boundary

#security #webdev #beginners

1 min read

Auth By Example

Sep 17

Default-deny beats allow-everything-then-trim

#security #beginners #webdev

1 min read

DEV Community

Auth By Example

Badges

Writing Debut

mTLS proves which service called you — not what it may do

OAuth scopes are not your app's authorization model

Creating a child resource still needs a check on the parent

Frontend route guards are not authorization

Feature flags are not access control

An internal network is not a permission

Batch APIs still need per-item authorization

Validate the JWT audience claim

Pull the tenant from the auth context, not the request body

Authorize the object, not just the route

Separate who can grant from who can act

Never trust a client-supplied tenant ID

Check permissions again after every trust boundary

Default-deny beats allow-everything-then-trim