Authorizing requests

Now that the user can authenticate themselves, the next step is to restrict access to operations based on the user’s identity so that actions can only be performed by authorized users.

The foundation for authorization is the authorization policy, which is a mapping between the operations the application provides and the users that are allowed to perform them. At its simplest, the mapping can be expressed as a simple list, as shown in Table 15.4 for the example application, which provides Add and Delete operations.

Table 15.4: A simple authorization policy

Operation	Authorized Users
Add	alice, bob
Delete	alice

The problem with this approach is that the authorization...