Auth By Example

Practical lessons on auth, authorization, and access control.

Joined on Sep 17, 2026 https://www.permit.io

Auth By Example

Sep 28

AI agents that inherit your OAuth token break least privilege

#authorization #ai #security #oauth

1 min read

Want to connect with Auth By Example?

Create an account to connect with Auth By Example. You can also sign in below to proceed if you already have an account.

Create Account

Already have an account? Sign in

Auth By Example

Sep 28

A share link is a scoped grant, not permanent access

#security #api #webdev #cybersecurity

1 min read

Auth By Example

Sep 28

Search results still need authorization filters

#security #api #webdev #cybersecurity

1 min read

Auth By Example

Sep 27

A list endpoint must filter by authorization

#backend

1 min read

Auth By Example

Sep 27

Email verified is not authorization

#security #api #webdev #cybersecurity

1 min read

Auth By Example

Sep 27

Rate limiting is not authorization

#security #api #webdev #cybersecurity

1 min read

Auth By Example

Sep 26

WebSocket subscribe is still authorization

#security #api #webdev #cybersecurity

1 min read

Auth By Example

Sep 26

MFA is not authorization

#security #api #webdev #cybersecurity

1 min read

Auth By Example

Sep 26

CORS is not authorization

#security #api #webdev #cybersecurity

1 min read

Auth By Example

Sep 25

Background jobs still need the caller's authorization

#security #api #webdev #permissions

1 min read

Auth By Example

Sep 25

OAuth scopes are not object permissions

#security #api #webdev #permissions

1 min read

Auth By Example

Sep 25

Frontend visibility is not authorization

#security #api #webdev #permissions

1 min read

Auth By Example

Sep 24

Service identity is not user permission

#security #api #backend

1 min read

Auth By Example

Sep 24

A tenant claim is not tenant isolation

#security #api #webdev #permissions

1 min read

Auth By Example

Sep 24

OAuth on MCP is not the same as authorizing each tool call

#security #mcp #api #authorization

1 min read

Auth By Example

Sep 24

Project access is not object permission

#security #api #webdev #permissions

1 min read

Auth By Example

Sep 24

A stale authorization cache is not a current permission

#security #api #webdev #permissions

1 min read

Auth By Example

Sep 23

Feature flags are not authorization

#security #api #permissions #webdev

1 min read

Auth By Example

Sep 23

Tenant membership is not resource permission

#security #api #webdev #permissions

1 min read

Auth By Example

Sep 23

Read permission is not export permission

#security #authorization #api #webdev

1 min read

Auth By Example

Sep 22

Page 2 of a list still needs the same authorization filter

#security #api #beginners

1 min read

Auth By Example

Sep 22

mTLS proves which service called you — not what it may do

#security #api #beginners

1 min read

Auth By Example

Sep 22

OAuth scopes are not your app's authorization model

#oauth #security #webdev #beginners

1 min read

Auth By Example

Sep 21

Creating a child resource still needs a check on the parent

#security #webdev #api

1 min read

Auth By Example

Sep 21

Frontend route guards are not authorization

#security #webdev #beginners

1 min read

Auth By Example

Sep 21

Feature flags are not access control

#security #webdev #beginners

1 min read

Auth By Example

Sep 20

An internal network is not a permission

#security #webdev #beginners

1 min read

Auth By Example

Sep 20

Batch APIs still need per-item authorization

#security #api #webdev

1 min read

Auth By Example

Sep 19

Validate the JWT audience claim

#security #webdev #beginners #authentication

1 min read

Auth By Example

Sep 19

Pull the tenant from the auth context, not the request body

#security #webdev #beginners #authorization

1 min read

Auth By Example

Sep 19

Authorize the object, not just the route

#security #webdev #beginners #authorization

1 min read

Auth By Example

Sep 18

Separate who can grant from who can act

#security #webdev #beginners

1 min read

Auth By Example

Sep 18

Never trust a client-supplied tenant ID

#security #webdev #beginners #authorization

1 min read

Auth By Example

Sep 18

Check permissions again after every trust boundary

#security #webdev #beginners

1 min read

Auth By Example

Sep 17

Default-deny beats allow-everything-then-trim

#security #beginners #webdev

1 min read

DEV Community

Auth By Example

Badges

Writing Debut

AI agents that inherit your OAuth token break least privilege

Want to connect with Auth By Example?

A share link is a scoped grant, not permanent access

Search results still need authorization filters

A list endpoint must filter by authorization

Email verified is not authorization

Rate limiting is not authorization

WebSocket subscribe is still authorization

MFA is not authorization

CORS is not authorization

Background jobs still need the caller's authorization

OAuth scopes are not object permissions

Frontend visibility is not authorization

Service identity is not user permission

A tenant claim is not tenant isolation

OAuth on MCP is not the same as authorizing each tool call

Project access is not object permission

A stale authorization cache is not a current permission

Feature flags are not authorization

Tenant membership is not resource permission

Read permission is not export permission

Page 2 of a list still needs the same authorization filter

mTLS proves which service called you — not what it may do

OAuth scopes are not your app's authorization model

Creating a child resource still needs a check on the parent

Frontend route guards are not authorization

Feature flags are not access control

An internal network is not a permission

Batch APIs still need per-item authorization

Validate the JWT audience claim

Pull the tenant from the auth context, not the request body

Authorize the object, not just the route

Separate who can grant from who can act

Never trust a client-supplied tenant ID

Check permissions again after every trust boundary

Default-deny beats allow-everything-then-trim