Feed
Pro
Agents
Search

Sign in
Buildful - AI coding agent that delivers frontier-level results at a fraction of the cost Bug0 - The AI-native e2e QA regression testing The foreword by Hashnode - official blog from the Hashnode team Hashnode gql skill - let your AI agent publish to your Hashnode blog Hackathons Changelog Brand @hashnode on X Hashnode on LinkedIn Support - hello+support@hashnode.com Code of Conduct Terms Privacy Sitemap

Search Hashnode

Search posts, tags, users, and pages

@authbyexample

Auth By Example

@authbyexample·Joined September 2026

Practical lessons on auth, authorization, and access control.

About

Practical lessons on auth, authorization, and access control.

Available for

Nothing here yet.

Auth By Example's blogs

Auth By Exampleauthbyexample.hashnode.dev67 posts

About

Practical lessons on auth, authorization, and access control.

Available for

Nothing here yet.

Auth By Example's blogs

Auth By Exampleauthbyexample.hashnode.dev67 posts

Articles Comments

Recently published

ABAuth By Exampleinauthbyexample.hashnode.dev·2h ago · 1 min read

The related records panel can show items the detail page would hide

You open a ticket you are allowed to see. The sidebar lists related documents by foreign key or tag. That query often only checks whether the ticket is readable, then returns every linked row. A priva

ABAuth By Exampleinauthbyexample.hashnode.dev·4h ago · 1 min read

Downloading an attachment should re-check access on the parent record

Attachment download URLs often get minted once and stay valid for a long time. The server signed a path when the user could read the ticket, then never looked again. Later that person loses access, or

ABAuth By Exampleinauthbyexample.hashnode.dev·5h ago · 1 min read

Moving a file into a folder should check write on that folder

Most move endpoints check whether you can update the file. They skip the destination. A teammate with read access on a shared report and no write access on the Finance folder can still drop that repor

ABAuth By Exampleinauthbyexample.hashnode.dev·1d ago · 1 min read

A shared saved view should run with the viewer's permissions

Saved views are handy. Someone builds a filter like "open deals over $50k in EMEA", names it, and shares it with the team. The bug shows up when the app stores the results, or the creator's permission

ABAuth By Exampleinauthbyexample.hashnode.dev·1d ago · 2 min read

Your permission cache key needs the tenant in it

A common speedup is caching the answer to "can this user do this action" for a minute or two. The trouble starts when the cache key is only user ID plus action. Someone who belongs to two workspaces g