authorization

[ltorresu82]

Is it possible to protect routes using for example casbin?

[linhub15]

Yes you can protect routes by using middleware. Basic, Bearer, JWT middleware is built in but for casbin you may have to create your own.

https://hono.dev/middleware/builtin/basic-auth

import { Hono } from 'hono'
import { basicAuth } from 'hono/basic-auth'
const app = new Hono()
app.get(
  '/secure',
  basicAuth({ 'admin', 'axkdu2w23' }),
  (c) => {
    return c.text('You are authorized')
  }),
)

[ltorresu82]

Yes, that is in the documentation. But what I mean is that you can discriminate access to a route by role and/or permissions. ¿?

[NicoPlyley]

I don't know if casbin would be compatible, I tried looking it up but didn't see any clear signs. But for making access based off a role is very easy to setup. I have an auth middleware and I pass it the roles I want to allow. Eg. auth('admin', 'editor') and it checks against the user and only lets those roles access the route. Otherwise throws a 401

[linhub15]

From what I see in casbin, there is no provided middleware for hono, but here are some of their other middleware you can use as an example.

• express-authz
• koa-authz

Then you can use the custom middleware on any route.

app.get(
  '/secure',
  casbinAuthz(<roles or permissions>),
   (c) => {
    return c.text('You are authorized')
  }),
)