Marmelab built simple_rest_rbac, an open-source Caddy module that enforces role-based access control on REST APIs. The middleware checks user permissions from a JSON configuration file, integrates with JWT authentication via placeholders, and returns 403 Forbidden for unauthorized requests. It uses the same permission format as React-admin's RBAC module, supporting wildcards and deny rules. The solution eliminates the need to reimplement authorization logic on both client and server sides.
Table of contents
The Problem: Full-Stack AuthorizationThe Solution: simple_rest_rbacFeaturesHow To Use It With Your APIWhy CaddyWriting A Caddy ModuleGetting The Role From JWTConclusionSort: