Security for Developers #3: Authorization — RBAC, OAuth 2.0, and OpenID Connect

Users → Roles → Permissions

Alex  → admin  → [create, read, update, delete]
Sam   → editor → [create, read, update]
Guest → viewer → [read]

package main

import (
    "net/http"
)

type Role string

const (
    RoleAdmin  Role = "admin"
    RoleEditor Role = "editor"
    RoleViewer Role = "viewer"
)

// Permissions for each role
var rolePermissions = map[Role][]string{
    RoleAdmin:  {"create", "read", "update", "delete"},
    RoleEditor: {"create", "read", "update"},
    RoleViewer: {"read"},
}

func hasPermission(role Role, permission string) bool {
    permissions := rolePermissions[role]
    for _, p := range permissions {
        if p == permission {
            return true
        }
    }
    return false
}

// Middleware that checks permission
func requirePermission(permission string, next http.HandlerFunc) http.HandlerFunc {
    return func(w http.ResponseWriter, r *http.Request) {
        role := getUserRole(r) // Get from JWT or session
        if !hasPermission(role, permission) {
            http.Error(w, "Forbidden", http.StatusForbidden)
            return
        }
        next(w, r)
    }
}

from functools import wraps
from flask import request, jsonify

ROLE_PERMISSIONS = {
    "admin":  ["create", "read", "update", "delete"],
    "editor": ["create", "read", "update"],
    "viewer": ["read"],
}

def require_permission(permission):
    def decorator(f):
        @wraps(f)
        def wrapper(*args, **kwargs):
            role = get_user_role(request)  # Get from JWT or session
            if permission not in ROLE_PERMISSIONS.get(role, []):
                return jsonify({"error": "Forbidden"}), 403
            return f(*args, **kwargs)
        return wrapper
    return decorator

@app.route("/api/posts", methods=["POST"])
@require_permission("create")
def create_post():
    # Only admin and editor can reach here
    return jsonify({"message": "Post created"})

@app.route("/api/posts/<post_id>", methods=["DELETE"])
@require_permission("delete")
def delete_post(post_id):
    # Only admin can reach here
    return jsonify({"message": "Post deleted"})

const ROLE_PERMISSIONS = {
    admin:  ['create', 'read', 'update', 'delete'],
    editor: ['create', 'read', 'update'],
    viewer: ['read'],
};

function requirePermission(permission) {
    return (req, res, next) => {
        const role = req.user.role; // From JWT middleware
        const permissions = ROLE_PERMISSIONS[role] || [];
        if (!permissions.includes(permission)) {
            return res.status(403).json({ error: 'Forbidden' });
        }
        next();
    };
}

// Usage
app.post('/api/posts', requirePermission('create'), createPost);
app.delete('/api/posts/:id', requirePermission('delete'), deletePost);

1. App redirects user to authorization server
2. User logs in and approves access
3. Authorization server redirects back with a code
4. App exchanges the code for tokens (server-to-server)
5. App uses the access token to call APIs

1. App generates a random code_verifier
2. App creates code_challenge = SHA256(code_verifier)
3. App sends code_challenge with the authorization request
4. When exchanging the code, app sends code_verifier
5. Server verifies: SHA256(code_verifier) == code_challenge

1. Server sends client_id + client_secret to authorization server
2. Authorization server returns an access token
3. Server uses the token to call the API

1. Device requests a device code and user code
2. Device shows: "Go to https://example.com/device and enter code: ABCD-1234"
3. User opens browser on phone, enters the code, and approves
4. Device polls the authorization server until approval is received
5. Device gets an access token

package main

import (
    "net/http"
    "golang.org/x/oauth2"
    "golang.org/x/oauth2/google"
)

var oauthConfig = &oauth2.Config{
    ClientID:     "your-client-id",
    ClientSecret: "your-client-secret",
    RedirectURL:  "http://localhost:8080/callback",
    Scopes:       []string{"openid", "profile", "email"},
    Endpoint:     google.Endpoint,
}

func handleLogin(w http.ResponseWriter, r *http.Request) {
    // Generate a random state to prevent CSRF
    state := generateRandomState()
    storeState(state) // Save in session
    url := oauthConfig.AuthCodeURL(state)
    http.Redirect(w, r, url, http.StatusTemporaryRedirect)
}

func handleCallback(w http.ResponseWriter, r *http.Request) {
    // Verify the state parameter
    state := r.URL.Query().Get("state")
    if !isValidState(state) {
        http.Error(w, "Invalid state", http.StatusBadRequest)
        return
    }

    // Exchange the code for a token
    code := r.URL.Query().Get("code")
    token, err := oauthConfig.Exchange(r.Context(), code)
    if err != nil {
        http.Error(w, "Token exchange failed", http.StatusInternalServerError)
        return
    }

    // Use token.AccessToken to call Google APIs
    _ = token
}

{
  "iss": "https://accounts.google.com",
  "sub": "1234567890",
  "email": "alex@example.com",
  "name": "Alex",
  "iat": 1700000000,
  "exp": 1700003600
}

// 1. Redirect user to Google
const authUrl = `https://accounts.google.com/o/oauth2/v2/auth?` +
    `client_id=${CLIENT_ID}` +
    `&redirect_uri=${REDIRECT_URI}` +
    `&response_type=code` +
    `&scope=openid profile email` +
    `&state=${randomState}`;

// 2. Handle the callback
app.get('/callback', async (req, res) => {
    const { code, state } = req.query;

    // Verify state
    if (state !== expectedState) {
        return res.status(400).send('Invalid state');
    }

    // 3. Exchange code for tokens
    const tokenResponse = await fetch('https://oauth2.googleapis.com/token', {
        method: 'POST',
        body: new URLSearchParams({
            code,
            client_id: CLIENT_ID,
            client_secret: CLIENT_SECRET,
            redirect_uri: REDIRECT_URI,
            grant_type: 'authorization_code',
        }),
    });

    const { access_token, id_token } = await tokenResponse.json();

    // 4. Decode and verify the ID token to get user info
    const user = jwt.verify(id_token, googlePublicKey, {
        algorithms: ['RS256'],
        issuer: 'https://accounts.google.com',
        audience: CLIENT_ID, // Verify the token was meant for your app
    });

    console.log('User:', user.name, user.email);
});