Feed
Pro
Search

Sign in
Darkshift - a dark factory for software Bug0 - The AI-native e2e QA regression testing The foreword by Hashnode - official blog from the Hashnode team Passmark - The open-source AI framework for regression testing Hashnode gql skill - let your AI agent publish to your Hashnode blog Hackathons Changelog Brand @hashnode on X Hashnode on LinkedIn Support - hello+support@hashnode.com Code of Conduct Terms Privacy Sitemap

Search Hashnode

Search posts, tags, users, and pages

@authbyexample

Auth By Example

@authbyexample·Joined September 2026

Practical lessons on auth, authorization, and access control.

About

Practical lessons on auth, authorization, and access control.

Available for

Nothing here yet.

Auth By Example's blogs

Auth By Exampleauthbyexample.hashnode.dev38 posts

About

Practical lessons on auth, authorization, and access control.

Available for

Nothing here yet.

Auth By Example's blogs

Auth By Exampleauthbyexample.hashnode.dev38 posts

Articles Comments

Recently published

ABAuth By Exampleinauthbyexample.hashnode.dev·6h ago · 1 min read

A websocket push is still an authorization decision

Subscribing a client to a channel after login is not the same as authorizing every event you later push on that socket. The bug pattern User connects with a valid session. Server joins them to tenant

ABAuth By Exampleinauthbyexample.hashnode.dev·8h ago · 3 min read

Soft-delete does not revoke access

Soft-delete is a data lifecycle choice. Authorization is a security decision. Mixing them up is how tombstoned rows keep answering "yes" long after the product thinks they are gone. The bug pattern A

ABAuth By Exampleinauthbyexample.hashnode.dev·11h ago · 2 min read

Authorization needs fresh attributes, not yesterday's snapshot

Most ABAC bugs I see are not bad rules. They are stale inputs. The policy says something like "finance can edit records tagged confidential, but only during business hours." That looks fine in a desig

ABAuth By Exampleinauthbyexample.hashnode.dev·1d ago · 3 min read

Your AI agent shouldn't be able to do everything you can

A common way to wire up an AI agent is to hand it the user's session or OAuth token and let it call APIs "as the user." It's quick, and it feels safe, because the agent can't do anything the user coul

ABAuth By Exampleinauthbyexample.hashnode.dev·1d ago · 1 min read

Impersonation tokens still need target-user authorization

When support or admin tooling mints an impersonation / "act as" token, validating that the operator is allowed to impersonate is only half the check. Every subsequent read and write must still authori