{"action":"closed","issue":{"url":"https://api.github.com/repos/strongloop/loopback/issues/474","labels_url":"https://api.github.com/repos/strongloop/loopback/issues/474/labels{/name}","comments_url":"https://api.github.com/repos/strongloop/loopback/issues/474/comments","events_url":"https://api.github.com/repos/strongloop/loopback/issues/474/events","html_url":"https://github.com/strongloop/loopback/issues/474","id":40452923,"number":474,"title":"Question: Is there any best practice to authenticate a Application via middleware ? Any example ? ","user":{"login":"nvdnkpr","id":219332,"avatar_url":"https://avatars.githubusercontent.com/u/219332?v=3","gravatar_id":"","url":"https://api.github.com/users/nvdnkpr","html_url":"https://github.com/nvdnkpr","followers_url":"https://api.github.com/users/nvdnkpr/followers","following_url":"https://api.github.com/users/nvdnkpr/following{/other_user}","gists_url":"https://api.github.com/users/nvdnkpr/gists{/gist_id}","starred_url":"https://api.github.com/users/nvdnkpr/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/nvdnkpr/subscriptions","organizations_url":"https://api.github.com/users/nvdnkpr/orgs","repos_url":"https://api.github.com/users/nvdnkpr/repos","events_url":"https://api.github.com/users/nvdnkpr/events{/privacy}","received_events_url":"https://api.github.com/users/nvdnkpr/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/strongloop/loopback/labels/doc","name":"doc","color":"d4c5f9"}],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2014-08-18T03:38:39Z","updated_at":"2015-11-18T21:21:26Z","closed_at":"2015-11-18T21:21:26Z","body":"My situation is that I've built my API and I wanted to have two kinds of applications:\r\n - an administrative application with possibilities to generally  CRUD the entitites, use bulk import & export, reporting etc. managing/monitoring the data hence not having that big set of restrictions.\r\n \r\n- an user application creating, working and handling data based on big set restrictions\r\n\r\nAs I'm going to organize the restrictions with the built-in ACL models, the best would If I could e.g. Deny a complete (published) model to the user application.\r\n\r\nIn order to do this, I need a way to authenticate the user application.\r\nI know that there are some base methods for Applications (http://apidocs.strongloop.com/loopback/#application-new-application) and my intuition tells me to use a middleware like the middleware used to authenticated the middleware via token. \r\n\r\nMy question therefore is more about the best practice. "}}