Favor Privileges over Role Checks βοΈ
A very common practice in web applications, especially those written using the ASP.NET built-in Role provider, is to perform role checks throughout the code to determine whether a user should have access to a particular page or control or command. π
For instance, you might see something like this β»οΈ :
The problems with the maintainability of this approach become apparent after a short while.βοΈ
For one, any buttons or other controls on the SomeSpecialControl above that post back to the page should also do a role check to ensure the user submitting the postback is in an acceptable role, otherwise a security hole may be present and users outside of these roles may be able to perform privileged actions. β οΈ
πΈπΉπΈπΉ
Introducing Privileges β
Wouldn't it be better to act like thisβ
This is very clear and is at the appropriate level of abstraction. π
CanEdit isnβt itself a privilege; we can look at it as a sort of helper method in this case that lets us write clear and concise code. β¨
https://t.me/pgimg/127
[ Full Article ] : bit.do/prauth
γ°γ°γ°γ°γ°γ°
#AspMvc #Authorization
@ProgrammingTip
A very common practice in web applications, especially those written using the ASP.NET built-in Role provider, is to perform role checks throughout the code to determine whether a user should have access to a particular page or control or command. π
For instance, you might see something like this β»οΈ :
if (User.IsInRole(Roles.Administrators))
{
SomeSpecialControl.Visible = true;
}
The problems with the maintainability of this approach become apparent after a short while.βοΈ
For one, any buttons or other controls on the SomeSpecialControl above that post back to the page should also do a role check to ensure the user submitting the postback is in an acceptable role, otherwise a security hole may be present and users outside of these roles may be able to perform privileged actions. β οΈ
πΈπΉπΈπΉ
Introducing Privileges β
Wouldn't it be better to act like thisβ
EditorPanel.Visibility = CurrentUser.CanEdit(CurrentArticle);
This is very clear and is at the appropriate level of abstraction. π
CanEdit isnβt itself a privilege; we can look at it as a sort of helper method in this case that lets us write clear and concise code. β¨
https://t.me/pgimg/127
[ Full Article ] : bit.do/prauth
γ°γ°γ°γ°γ°γ°
#AspMvc #Authorization
@ProgrammingTip
Telegram
Programming Tips Resources