Attribute based access control module for cross-origin web requests

Abstract

The article analyzes the possibilities of the RBAC and ABAC standards for managing access to resources from various sources.  One of the advantages of ABAC is that it allows you to describe an infinite number of different scenarios without the need to create new roles, which allows you to create and modify rules more flexibly. The article highlights the following advantages of ABAC: the ability to describe access control in terms close to the terms of the business logic of the application, the ability to significantly automate the creation of both simple and complex access control rules, including rules with dynamic parameters. The XACML language is used to describe access control rules. Currently, the CORS standard is used to control access to web resources from different sources.

This article explores the module architecture for the Node.js framework for attribute-based access control for cross-domain origins. The module includes basic tools for setting up ABAC and CORS in Node.js applications. The module provides a web interface with which the service administrator can change the set of rules for various access points (Endpoints) of the application in real-time mode. The module satisfies the following functional requirements: web interface for setting up access rules; declarative configuration of cross-domain requests for different origins (CORS); configuring attribute-based access to both the entire application and individual access points. The description of the module operation in accordance with XACML is given.