Authorization

Authorization is the process of deciding what an authenticated user is allowed to do. Not every user should have the same level of access.

RBAC: Role-Based Access Control

In RBAC, different roles are assigned different permissions (read/write/update/delete).

For example:

• admin: full access
• editor: create and update
• viewer: read-only

Usually, a role claim is included in the token, and the backend checks that role before granting access to a protected action.

Error Messages

In authentication flows, error messages must be designed carefully.

Examples:

• user not found
• invalid password
• account locked due to many failed attempts

NEVER SEND SPECIFIC MESSAGES

Use a generic response like Authentication failed.

Why? Specific errors can leak account information and help attackers enumerate valid users.

Timing Attack

Typical auth flow:

1. Find user
2. If email exists, check account status
3. Compare password with stored hash

If the user does not exist, systems often return early and respond faster. If the user exists, password-hash comparison takes more time.

This response-time gap can reveal whether a user exists.

Authentication logic should minimize timing differences as much as possible.

Validations and Transformations

Bottom layer is the repository layer. It includes database access and data persistence. Then we have the service layer, which defines business functionality. Controllers call the service layer and handle HTTP concerns (request/response). All data that comes from the client and goes back to the client is mediated by controllers.

Validation happens when the client sends a request to the controller.

API -> Validation -> Controller

(bottom) Repository -> Service -> Controllers

Common Types of Validation

1. Syntactic Validation - Email format, phone format, date format
2. Semantic Validation - Whether data makes sense (future birthdate, impossible age)
3. Type Validation - String, Boolean, Number, Array, JSON

Checking if password and confirm password match is also a form of complex validation.

Transformation

Client -> Validation and Transformation Pipeline -> Controller

All query params are strings by default, so we often need to transform data before proper validation. If a field should be a number or boolean, we should cast it before applying strict rules.

Converting input into the desired format is called transformation.

Well-structured validation errors help clients understand what the API expects.

Transformation can also include reshaping data structures.

![[Pasted image 20260219134435.png]]

Frontend Validation and Server-Side Validation

In forms, we do validation on the frontend for better UX. Frontend validation is helpful, but it is not a security boundary. Backend validation is mandatory for security and data integrity.

Handlers, Services, and Repositories

Handler is a predefined function that handles API requests.

Handler / Controller

Handler contains the request and response objects.

You should validate all client input.

The service layer should be isolated from transport details (HTTP, UI). It takes validated data and applies business rules.

A repository method should usually do one clear data-access job, while a service may orchestrate multiple repository calls.

Controllers: Binding, validation and transformation, call service, and send success/failure responses to the client.

This is how everything works in API flow

Middlewares

The moment the client sends a request, we can run different functions before the final handler.

![[Pasted image 20260219175613.png]]

A handler gets request and response objects at runtime.

Middlewares get request, response, and next.

The next() function passes execution to the next middleware or handler.

Middleware can also modify the request before it reaches handlers.

Why we use middlewares:

We don't want to write the same logic every time, so we reuse common logic across different requests.

Example: logging, auth checks, and security headers.

Middleware examples:

1. Security - CORS, security headers, auth header checks, rate limiting
2. Logging and Monitoring - Server logs for debugging and auditing
3. Global error handling - Distinguish client/server errors with structured responses
4. Compression - Large JSON responses can be compressed with gzip
5. Data Parsing - for serialization and deserialization

Request Context

Request Context is a request-scoped storage area used by middleware and handlers.

It is state scoped to one API call.

Each request has its own context, which can carry values such as user ID, correlation ID, or trace metadata.

Context is accessible across middlewares and handlers, which keeps the system less coupled while still sharing useful request-level state.