CbSecurity has some fine mechanisms to work with user permissions (the CbAuth validator) or user roles (CFML Security validator). The cbauth validator is really flexible, but sometimes you still need more options. In one of our projects our users can have one or more fixed roles and we assigned several permissions to each role. Our rules looked like this:

{
  secureList  : "auth.Customers\.index",
  permissions : LIST_CUSTOMERS
},
{
  secureList  : "auth.Customers\.show",
  permissions : SHOW_CUSTOMERS
},
{
  secureList  : "auth.Customers\..*",
  permissions : MANAGE_CUSTOMERS
},
// ......
// block all rule
{
  secureList  : ".*",
  permissions : "JUST_A_PLACEHOLDER",
  whitelist   : whiteRules.toList()
}

This is only a very small part of our rules. We had to keep track of all kind of permission names (and we put them in variables to prevent typo’s) and still had to assign these permissions to a fixed set of roles. Quite some administration. We decided we had more wishes, in our case:

1. each individual endpoint should have its own permission for very fine-grained control.
2. any number of roles which we can create in an API
3. assignment of permission to these roles in the API
4. assignment of roles to users in the API
5. and since we are using a VueJS frontend, we wanted a list of ALL available endpoints (based on permissions) for a user

No, this is not a typo. This post will tell you how to prevent some headache with JWT iss claims in cbsecurity. It is quite easy to solve, but since I just spent several hours debugging some very nasty JWT authentication problem, I thought it might be worth sharing. Bottom line: if you are using the iss claim in JWT make sure you specify it yourself, so don’t rely on the default (although that might look attractive). Better yet: ALWAYS specify the issuer claim, even if you think you are not using it. Only read the rest of this post if you really want to know why.