(Is this the best forum for this type of question?)
I'm writing a web application which allows approved users to login, and perform various tasks, depending on the security role(s) they have been assigned.
I'm guessing that to prevent users from performing tasks that their roles don't permit, this should probably entail 2 main phases:
- Present web pages which contain only the options (menus, pages, buttons, fields, etc) that the user should be able to access, on the web pages. (This is basically working, already.)
- In case a user tries some hacking (e.g. posting fields/values which their webpage doesn't allow them to post), double check all actions before processing them. (This sounds pretty complex in some areas, to me.)
Does this strategy sound appropriate/normal/necessary? Any tips or links to pages which discuss this, before I possibly spend a lot of time going down the wrong track?
I'm using Perl/MySQL on Linux, though the principles might be generic.