Seeking advice on optimizing user authorization with RBAC using Casdoor Go SDK about casdoor

[casbin-bot]

@tangyang9464 @JalinWang @imp2002

[hsluoyz]

@nemirlev why don't you just use the permissions property inside the JWT? I think the JWT already contains permissions by default? See:

casdoor/object/token_jwt.go

Lines 363 to 387 in 57431a5

	if application.TokenFormat == "JWT" {
	claimsWithoutThirdIdp := getClaimsWithoutThirdIdp(claims)
	token = jwt.NewWithClaims(jwt.SigningMethodRS256, claimsWithoutThirdIdp)
	claimsWithoutThirdIdp.ExpiresAt = jwt.NewNumericDate(refreshExpireTime)
	claimsWithoutThirdIdp.TokenType = "refresh-token"
	refreshToken = jwt.NewWithClaims(jwt.SigningMethodRS256, claimsWithoutThirdIdp)
	} else if application.TokenFormat == "JWT-Empty" {
	claimsShort := getShortClaims(claims)
	token = jwt.NewWithClaims(jwt.SigningMethodRS256, claimsShort)
	claimsShort.ExpiresAt = jwt.NewNumericDate(refreshExpireTime)
	claimsShort.TokenType = "refresh-token"
	refreshToken = jwt.NewWithClaims(jwt.SigningMethodRS256, claimsShort)
	} else if application.TokenFormat == "JWT-Custom" {
	claimsCustom := getClaimsCustom(claims, application.TokenFields)
	token = jwt.NewWithClaims(jwt.SigningMethodRS256, claimsCustom)
	refreshClaims := getClaimsCustom(claims, application.TokenFields)
	refreshClaims["exp"] = jwt.NewNumericDate(refreshExpireTime)
	refreshClaims["TokenType"] = "refresh-token"
	refreshToken = jwt.NewWithClaims(jwt.SigningMethodRS256, refreshClaims)
	} else {
	return "", "", "", fmt.Errorf("unknown application TokenFormat: %s", application.TokenFormat)
	}

If you are using "JWT" format option, you already have:

casdoor/object/token_jwt.go

Lines 242 to 244 in 57431a5

	Roles: user.Roles,
	Permissions: user.Permissions,
	Groups: user.Groups,

[nemirlev]

@hsluoyz Hello.

Because the token is transferred from the client to the server. It is stored in cookies, and this is a problem. There is a size limit. We can use roles instead, and we will solve this problem, but then we will not have atomicity.

[hsluoyz]

You should store it in local storage then

[nemirlev]

@hsluoyz It's not safe.

https://auth0.com/docs/secure/security-guidance/data-security/token-storage#don-t-store-tokens-in-local-storage