May 2023 Summaries

Frontend developers can now send SMS and messages via WhatsApp, Viber, and Facebook Messenger directly from the browser without any backend code, thanks to a method called Frontend Only Authorization (FoAz). FoAz, developed by Permit.io, utilizes a proxy service to verify a user's frontend JWT token, which checks their permissions before allowing API calls to backend services like Vonage. This approach is showcased in a tutorial using the React framework, where users are authenticated through Clerk.dev, and permissions are managed via Permit.io. The tutorial demonstrates how to create a messaging app, set up user authentication and permissions, and send messages using Material UI for the user interface. The article highlights FoAz's potential for accessing any API that requires authentication, enabling the development of full applications without traditional backend components.

Permit.io has introduced Frontend-only-Authorization (FoAz), a novel feature that allows frontend developers to use sensitive APIs directly from the frontend without backend code, while ensuring robust security. FoAz addresses the need for enhanced permission models and granularity by acting as a proxy that checks API calls against policies and identities, allowing only authorized actions. This innovation facilitates direct API calls to services like Twilio, OpenAI, and Stripe without backend involvement, significantly boosting the efficiency and autonomy of frontend developers. Built on Permit.io’s low-code interfaces, FoAz aims to empower developers by enabling faster and secure feature deployment, and it is offered both as a ready-to-use SaaS and an open-source standard.

The blog post discusses implementing an efficient authorization system in an Express application using the Permit.io service to streamline permission management. It critiques the traditional approach of embedding policy logic directly into middleware, which can become cumbersome and error-prone as the application scales. Instead, it proposes designing a clear permissions model—separating policy logic from enforcement—and utilizing Permit.io for defining and managing roles, resources, and actions outside the application code. The article illustrates this with a demo Express-based blogging application, detailing how Permit.io's SDK can be integrated to manage permissions through both Role-Based Access Control (RBAC) and more complex Attribute-Based Access Control (ABAC) models without altering the core application logic. By leveraging Permit.io, developers can focus on critical application logic while ensuring robust and scalable permission schemes.

AWS has introduced Cedar, a new policy language aimed at enhancing application-level authorization by separating policy configuration from application code, allowing for a more scalable and maintainable system. Cedar is specifically designed for application-level authorization, unlike other multi-purpose policy languages, and offers benefits such as easier scaling, fewer bugs, faster response times, and improved security. The article discusses using open-source projects like Cedar-Agent and OPAL to build a comprehensive and scalable authorization system, emphasizing the importance of separating the policy configuration from code and using Infrastructure as Code (IaC) for setup. The OPAL-Cedar example repository is explored, highlighting the use of Git for policy storage, Docker for local setups, and the hierarchical structuring of data for policy decisions. The system facilitates auto-scaling of decision points and enforcement of permissions through a centralized administration point, with practical examples provided in Node.js and Python applications. The setup supports scalable management of both permissions and data sources, demonstrating how policy changes can be implemented without altering application code, ultimately offering a robust framework for managing authorization at scale.

Permit.io's integration with AWS Cedar introduces a significant advancement in application-level authorization by utilizing Cedar's open-source Policy As Code (PAC) language and engine, designed to improve identity and access management through fine-grained access control policies. The integration, which is available for early access, provides features such as a low-code/no-code policy editor, seamless management via a control plane, and additional functionalities like multi-tenancy support and audit logs. Permit.io enhances the adoption of Cedar with tools like OPAL and Cedar-Agent, enabling the deployment of real-time policy updates and independent management of policies using the Cedar language. By building on Amazon Verified Permissions or Cedar-Agent, Permit.io offers a robust platform for policy management that aligns with cloud-native infrastructures, allowing flexibility and improved auditability in managing permissions and access control.

Role-based access control (RBAC) has long been a standard authorization method, allowing permissions to be assigned based on predefined roles. However, as applications become more complex, RBAC often falls short, prompting the need for Attribute-based access control (ABAC), which provides a more nuanced and flexible approach by considering various attributes like user data, location, and time. Transitioning from RBAC to ABAC, especially in applications with intricate authorization needs like fintech, poses significant challenges, requiring extensive research and development to redefine permissions management systems. Permit.io offers a solution by simplifying this migration process with a no-code permissions management interface that helps define policies without substantial code changes, addressing performance issues and allowing organizations to adapt to evolving security and compliance demands. While ABAC offers enhanced adaptability, the transition can be demanding, but tools like Permit.io can ease the process by providing intuitive management and implementation solutions.

Policy as code (PAC) is a development approach that treats authorization policies as code, using languages like Rego and Cedar, which are stored in version control systems. Rego, associated with the Open Policy Engine (OPA), and Cedar, used by Amazon Verified Permissions, both focus on decoupling policy from code, enhancing performance, and supporting scalability and auditability. While both languages share common traits such as being open-source and supporting WebAssembly compilation, they differ in focus, language design, and ecosystem. Rego is more flexible and infrastructure-oriented, with a mature ecosystem, but it can be complex and less readable. In contrast, Cedar is more application-oriented, readable, and structured, backed by AWS, but has a smaller ecosystem. Tools like Permit.io can assist in adopting these languages by providing a low-code UI to generate code, facilitating easier adoption and flexibility in using or switching between Rego and Cedar. The choice between them depends on specific use cases and requirements, but tools can help simplify the learning curve and initial adoption.

AWS has introduced Cedar, an open-source project that marks a significant development in managing permissions and access control in cloud-native environments, by allowing organizations to handle the complexity of in-app permissions through policy as code. Traditional methods like access control lists and role-based access control have struggled to scale with the increasing number of users and resources, making policy as code a more scalable and auditable solution. Cedar stands out due to its readability, enabling even non-technical stakeholders to understand policies, alongside features like policy testing and simulation for better enforcement. Permit.io supports Cedar by offering a SaaS service and the Cedar-agent, a companion open-source project that allows Cedar to function as a standalone agent, integrated with OPAL (Open Policy Administration Layer) to ensure consistent policy enforcement across systems. This integration simplifies the process for developers, as policies can be written once and applied across different tools, reducing cognitive load and enhancing scalability in managing permissions.