So, I believe I understand the logic behind authorization standards like OAuth. The OAuth token contains information about the user (name, role, etc.), which I can use to secure my application.
It's about the last part of the previous sentence that I have a question. Let's say I have a web app with 1000 articles, how do I check whether or not a specific user (based on his/her OAuth token) has access to a certain article? I see several options:
- I store all ID's of the articles that the user can see in the OAuth token (e.g. ID1, ID2, ID3, etc.);
- Conversely, I can also store which users may access the article (e.g. Article 1 can be read by users 1,2,3). This is like an ACL;
- For every article, I store which roles can access that article (e.g. Article 1 can be read by role: reader). This is like RBAC;
- Do not secure your content at all, just like Facebook seems to do (although they do secure it, but they just check your friend list before giving you the direct url to the resource).
To clarify: I am not searching for an answer that explains that you can put claims in the token itself, so that you do not have to hit the db to retrieve your claims (stateless). I am looking for ways how the application back-end uses these claims to decide whether or not access to a certain content item is granted.
- Option 1 seems bad practice, as the tokens will become infinitely huge for large providers.
- If large providers use option 2 or 3, they will have a huge amount of database hits (check if that article can be accessed by that user), which can't be good for performance. This performance increase is one of the reasons Facebooks and Twitters use stateless authorization, instead of stateful authorization. I would assume that this performance penalty on content level is a blocker against using either option 2 or 3.
- So, is the only viable option to go with 4?
A last option I see is to use option 3, combined with heavy caching. As content permissions are not as ephemeral as user rights, this is the option I would go for. But is this how large providers (Google, Twitter, Dropbox, etc.) do it? And how is it implemented practically?
Someone told me about Spring's permission matrix which you can put in memory, but I'm not sure whether this would be the way to go..