Authorization

An authorization framework that enables third-party applications to obtain limited access to a web service on behalf of a resource owner, without exposing credentials.

A security model based on the principle of 'never trust, always verify' that requires strict identity verification for every person and device attempting to access resources, regardless of network location.

RBAC

An access control model that assigns permissions to users based on their organizational roles, simplifying access management by grouping permissions into roles rather than assigning them individually.

ABAC

An access control model that evaluates access requests based on attributes of the user, resource, action, and environment, enabling fine-grained, context-aware authorization decisions.

The practices, patterns, and technologies used to protect application programming interfaces from unauthorized access, data breaches, and abuse, including authentication, authorization, rate limiting, and input validation.

A mechanism in OAuth 2.0 that limits the access granted to a client application, defining specific permissions the client can request and the resource owner can approve.

An OAuth 2.0 grant type where the client receives an authorization code from the authorization server and exchanges it for access and refresh tokens via a back-channel request, providing the most secure flow for server-side applications.

PKCE

An extension to the OAuth 2.0 Authorization Code flow that protects against authorization code interception attacks by requiring the client to create a cryptographic code verifier and challenge.

A security principle that grants users, applications, and systems only the minimum access rights and permissions necessary to perform their required tasks, reducing the attack surface and blast radius.