Skip to content

Authorization

Authorization User to Your app: bob: PUT /articles/7. Your app to Policy engine: may bob PUT /articles/7? Policy engine to Your app: deny. Your app to User: 403 Forbidden. User to Your app: GET /users/%0A. Your app to User: 400, before asking. One dependency, whatever engine holds the policy. User Your app Policy engine bob: PUT /articles/7 may bob PUT /articles/7? deny 403 Forbidden GET /users/%0A 400, before asking One dependency, whatever engine holds the policy
What it's for: a policy, not checks spread over the routes, decides who may do what, with the engine in the process (Casbin, Cedar) or as a service apart.

A policy decides who may do what, checked by FastAPIAuthz for each route or each action, and by AuthzMiddleware for every request, whatever engine holds the policy:

  • In process, with the policy in the app's memory:
    • Casbin: a newsroom whose roles write, edit, publish and grant roles.
    • Cedar: a team's documents, read and edited as their attributes allow, where contractors never see a confidential one.
  • As a separate service, one policy decision point that every service asks:
    • Open Policy Agent: a shop whose orders and refunds a Rego policy decides, by the user's roles and the order's total.

Each example runs with uvicorn and its own users, tokens and data; the commands in its page show what each user gets.