# Authentication and authorization framework re-work

**URL:** <https://talk.openmrs.org/t/authentication-and-authorization-framework-re-work/49318>\
**Category:** Development\
**Created:** [April 16, 2026, 9:37am UTC](https://talk.openmrs.org/t/authentication-and-authorization-framework-re-work/49318 "2026-04-16T09:37:38Z")\
**Posts on this page:** 1\
**Showing post:** 4

<div class="post-metadata">

**Author:** ![praneeth622](https://talk.openmrs.org/user_avatar/talk.openmrs.org/praneeth622/32/22128_2.png) [@praneeth622](https://talk.openmrs.org/u/praneeth622)\
**Post date:** [April 19, 2026, 2:40pm UTC](https://talk.openmrs.org/t/authentication-and-authorization-framework-re-work/49318/4 "2026-04-19T14:40:04Z")

</div>

@ibacher re: your note that the ‘finally using authentication in O3’ GSoC project is active this year, I’ve shared a detailed frontend architecture in thread [49131](https://talk.openmrs.org/t/gsoc-2026-o3-frontend-architecture-for-authentication-module-integration/49131) (openmrsFetch Location-header contract, 2FA polling, requirePasswordChange routing). Would appreciate your thoughts whenever you have a moment specifically on whether the frontend should negotiate the response version or gate behind a feature flag.

---

_[View the full topic](https://talk.openmrs.org/t/authentication-and-authorization-framework-re-work/49318)._