reading-notes

---

Project maintained by mr-atta Hosted on GitHub Pages — Theme by mattgraham

Access Control (ACL)

When is Basic Authorization used vs. Bearer Authorization? 📁

• Basic authentication transmits credentials as (user ID/password) pairs, encoded using base64.

• The client sends HTTP requests with the Authorization header that contains (Basic word followed by a space and a base64-encoded string) »» username:password

  Authorization: Basic ZGVtbzpwQDU1dzByZA==

• Bearer authentication (called token authentication) has security token. The “Bearer authentication” can be understood as “give access to the bearer of this token.” The bearer token is a cryptic string, usually generated by the server in response to a login request.

• The client must send this token in the Authorization header when making requests to protected resources:

  Authorization: Bearer < token >

What does the JSON Web Token package do? 📁

• JSON Web Token (JWT) defines a compact and self-contained way for securely transmitting information between parties as a JSON object. This information can be verified and trusted because it is digitally signed.

What considerations should we make when creating and storing a SECRET?📁

• stor it in the dotenv file

• Never store unencrypted secrets in .git repositories

• Don’t share your secrets unencrypted in messaging systems

• use IP whitelisting to prevent any untrusted sources from accessing your GitHub repositories.

<hr>
<hr>

VID: RBAC tutorial
<hr>

📁 5 steps to RBAC
<hr>

📁 wiki - RBAC