I’m in the progress of developing a web application. This web application is mostly a CRUD interface, although some users are only allowed to perform some actions and see only some parts of views.

What would be a reasonable way to handle user permissions, given that some parts of views are not available to users? I was thinking of having a function hasPermission(permission) that returns true iff the current user has the given permission, although it would require conditionals around all parts of views that are only visible to some users. For example:

{% if has_permission('view_location') %}
    {{ product.location }}
{% endif %}

I’m fearing this will become an ugly and unreadable mess, especially since these permissions can get kind of complicated.

How is this problem commonly solved in web applications?

I’m considering using Haskell with Happstack or Python with Django.

  • if you are using django, I'm not certain as I have basic knowledge of the framework, but I think you can extend a template, maybe you can extend the template depending which permissions, then you have different templates for different users called, and avoid bugs? – user50236 Oct 22 '13 at 13:14
  • 1
    You're doing it correctly. If you just need to inhibit data being passed to the view for which your user doesn't have permission, you can do that in the Controller, or even the Model. But if you're trying to suppress portions of a view from being displayed, the View is the place to do that. – Robert Harvey Oct 22 '13 at 22:05

I'm not sure how it is normally accomplished in other frameworks, but I created a small PHP framework that essentially had a similar method to the one you described to trigger permission logic.

I would imagine in Django you could create different view templates that include or not include the parts of the view that need permissions and return different views based on permissions, which could be controlled mostly in views.py. I'm not really sure how else you could accomplish permission logic any more simply than a simple flag or returning different views.


You could store the permissions in the user table in your database:


Then just check the appropriate fields before letting a given user access one part of the system or perform a certain activity.

  • This kinda makes user maintenance difficult, especially if the one doing the maintenance is new, or doesn't completely understand what each permission does. – Justin E Jan 17 '14 at 19:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.