Hacker News Reader

I’ve heard of these!

The fly.io blog has a really cool write-up about them.

Definitely an under appreciated concept.

IIUC, you can even validate the “sub issued” macaroons offline, provided you know the validity of one of its ancestors up the chain. Is this correct, or am I misunderstanding?

View on HN

I think that's correct since each added caveat builds on the previous one.

I don't have the formal knowledge to understand the full underpinnings of it, but it always seemed to me (from implementing validation of them and looking at many authZ systems) that many of the sharing and delegation features of current apps would be so much neater in a macaroon based system.

here is the mentioned blog post for anyone interested (and lazy): https://fly.io/blog/api-tokens-a-tedious-survey/

Reply on news.ycombinator.com