Let's say that we have some sort of "schema" for a rest resource, something like (pseudocode):

     field1 = field(validate=is_string())
     field2 = field(validate=is_int())
     field3 = field(validate=is_string(max_length(200))
     creator_id = field(validate=is_int())

Depending on the permissions the user has, his access should be limited. For example, we might have a user that can POST new resources, but can only PATCH the resources he has created (creator_id is equal to his unique id), we might have another user that can GET all resources, but only has permissions to view field1 and field2 on the resources, we might have a user who only has permissions to PATCH field2 on all resource, etc.

So my question is - would checking the users permissions be part of validating? Something like this:

    field = field(validate=[is_string(), check_permission(create=permission1, edit=permission2, view=permission3)])

I am currently working on a project where permission checks are implemented this way, and I am looking for some input on this - is this good practice? Does it make sense? How else would you implement this?

My own thoughts: On the one hand, since each field is checked for validity anyway, it kind of feels efficient to also check for permissions at the same time - otherwise, you would first have to go through all the fields and check all the permissions, and then go through all the fields again to validate them. On the other hand, this kind of design doesn't feel very SOLID to me.

1 Answer 1


Since permission should be on a resource level you generally check permissions on a resource before you start validating data, since what is the point of starting validation of the data if the user lacks the permission to change it.

This is how most web frameworks work, permission checking happens right after routing. Once the user is granted access to update the resource then you start validating the data they sent to the server, or constructing a particular view based on the users permission level or group.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.