https://blog.yusukeikoma.com/tags/authorization/Recent content in authorization on Ikoma's BlogHugoen-usThu, 17 Sep 2026 09:49:13 +0900https://blog.yusukeikoma.com/posts/ignoring-unknown-jwt-claims-only-removes-access/Thu, 17 Sep 2026 09:49:13 +0900https://blog.yusukeikoma.com/posts/ignoring-unknown-jwt-claims-only-removes-access/The JWT specification tells verifiers to ignore claims they do not understand. That is harmless for claims that grant things and dangerous for claims that restrict them. Four ways to cap what a client kind may hold, tested with a small issuer and three verifiers, and the one I would pick.https://blog.yusukeikoma.com/posts/separate-authentication-and-authorization/Tue, 11 Aug 2026 17:14:04 +0900https://blog.yusukeikoma.com/posts/separate-authentication-and-authorization/Designing API authentication and role-based authorization with actors, route permissions, and separate credentials for people and machines.