I Made Four Authorization Engines Answer the Same Questions
"Which authorization engine should I use" always gets answered with a table. Cedar is analyzable, Rego is expressive, Zanzibar is relationship-based. I could never feel the difference from any of it. So I gave four of them the same rules and ran every possible request through all four at once. Live demo: https://0-draft.github.io/authz-playground/ Repo: 0-draft/authz-playground One square is one…
Four authorization engines were tested with the same set of rules and presented with every possible request simultaneously. The results were visualized through a live demo and a GitHub repository. The engines included Cedar, Rego, Zanzibar, and Casbin, each having its unique strengths and weaknesses. Cedar is analyzable, Rego is expressive, and Zanzibar is relationship-based.
The comparison revealed that ReBAC fell short when it came to handling time-based constraints, specifically during business hours. This weakness was due to the fact that ReBAC's authorization check engine does not include a clock argument, resulting in it allowing edits at any time, including outside of business hours. The discrepancy became apparent when a third rule was added, which restricted edits to only during business hours, highlighting the gap between ReBAC and the other engines.
The source material also highlights the challenges of comparing different authorization engines and the importance of thoroughly evaluating all aspects of each engine to ensure accurate comparisons.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
