Tech blog
Demos, implementation guides, product updates and broader takes on authorization, identity and security.
Determining service boundaries and decomposing your monolith
The first major hurdle when decomposing a monolith app is defining appropriate boundaries for each microservice. We’ll cover how to break down a monolithic app into smaller, independently deployable services that align with business capabilities.
Why granular, scalable control is a must for every CTO
Fine-grained authorization and access control in modern applications - learn how to transition from basic RBAC to ABAC using externalized authorization. Discover best practices for implementing scalable permission systems in microservices architectures, ensuring compliance, and managing technical debt through policy-driven security approaches.
Easy way to put user role in JWT
Learn about embedding user roles in JWTs for managing access control in your applications. Use the technique described in this article with care. If you end up abusing this method, you'll fall into the bloated JWT anti-pattern.
Using Cerbos authorization with JSON Web Tokens
Learn how to implement Cerbos authorization in JWT, in a JavaScript application using Next.js. This guide demonstrates combining JSON Web Tokens for secure authentication and Cerbos' policy-based engine for robust authorization, enabling simple access control management for your APIs.
Why you need to think about both your security and users when implementing authorization
Explore how a finely-tuned authorization system balances security and user experience, ensuring compliance with global regulations like GDPR and CCPA. Learn strategies to design scalable, user-friendly permissions that align with business goals, enhance customer trust, and meet enterprise needs without compromising cybersecurity.
How to implement authorization in React JS
In this blog, we will learn how to implement an authorization mechanism in ReactJS applications using Cerbos.
PBAC vs. Zanzibar: Finding The Right Fit For Your Application
Discover the key differences between PBAC and Zanzibar to find the ideal authorization solution for your application. Learn how PBAC with Cerbos offers a flexible, scalable access control solution, while Zanzibar excels in centralized, fine-grained management for static resources. Find the right fit for your needs.
It’s Time to Ensure Your Security Is as Scalable as Your Business
Discover how stateless authorization enhances security, scalability, and flexibility in software development. Learn why industry leaders like NTWRK and Loop are embracing this approach to improve application performance, reduce latency, and simplify policy updates. Ensure your software's security is as scalable as your business.
Badly Designed Authorization is Technical Debt
Optimize authorization in software engineering by decoupling business logic from code. Avoid hard-coded access controls that lead to technical debt. Centralize authorization decisions with tools like Cerbos, allowing for flexible, scalable, and secure policy management, independent of the application codebase.
Cerbos PDP v0.38.1 Release Highlights: Policy Variables, SBOM Support, Improved Error Messages and Helm Updates
The Cerbos PDP v0.38.1 release includes policy variables, SBOM support, improved error messages, Helm updates. Read this blog to learn more.
401 vs 403 Error Codes: What's the Difference?
Error codes 401 and 403 are related to each other, and because of that, sometimes they tend to be mixed up together. In this article, we're going to review what each of these error codes mean—and what you can do to solve them.
How to implement authorization in a Gorilla application
In this post, we discuss implementing authorization in a Gorilla application & provide a step-by-step guide for doing so using Cerbos. Read more here.
Recommended content
Mapping business requirements to authorization policy
eBook: Zero Trust for AI, securing MCP servers
Experiment, learn, and prototype with Cerbos Playground
eBook: How to adopt externalized authorization
Framework for evaluating authorization providers and solutions
