Cookies
Security
¶ Authentication and RBAC
Authentication proves who the user is with httpOnly JWT cookies. RBAC decides what they can do inside each organisation.
httpOnly JWT cookies
16 seeded permissions
4 role templates per organisation
require_permission()
Authentication
¶ Cookies carry the session everywhere
Authentication uses httpOnly access and refresh JWT cookies. The browser sends them automatically; page scripts can't read them.
RBAC
¶ Permissions, cloned per organisation
4 system role templates, cloned per organisation
owner
admin
agent
viewer
The gate
¶ Gate REST endpoints with require_permission()
Use it on REST endpoints so the caller's permission in the current organisation is checked before the endpoint does any work.
Permissions16 seeded permissions.
Roles
owner, admin, agent, viewer templates, cloned per organisation.
Endpoint checkAdd require_permission() to REST endpoints.