Separate authentication and authorization

[Bilal_khan]

I have been working on separate authentication and authorization. Authentication with a firebase as well as an authorization with fauna DB.

What would be the best and secure way to achieve authorization with fauna DB?

[databrecht]

There is no single answer on that question since Fauna in contrary to Firebase is not really opinionated on how to implement authentication. But there is a lot written around the subject on the forum:

Do I need a backend API between FaunaDB and my app? What are the use cases of an API?

Use cases for using an API in between FaunaDB and your app httpOnly cookies which adds security (see later on whether it’s necessary or not) Extra monitoring If you want something like IP-based rate-limiting If you’d like to implement some logic in your backend (although most if not all logic can be implemented in FQL and it’s imho a good idea to have your logic close to the data (some people don’t like that idea). Being in control, some programmers just want more control and see everything pas…