I am working on a project where you have controllers that expose an API and services that implement some logic.

In this project, each service* checks for the user's permissions to use the service.

When asked, I am told it makes life easier to the service's consumers because they don't have to bother themselves with permissions.

The code in this design looks like so

public Response addItem(@RequestBody Item item){
    itemHandler.add(item); // this call actually does the permissions verification

However, I am familiar with another design where controllers are responsible for permission checking before activating the service.

This design keeps the services simple and unaware of any permissions mechanism, and the liability for security lies on the consumer.

public Response addItem(@RequestBody Item item, Request request){
    if (hasPermissions(request)){
        itemHandler.add(item);  // is not concerned/aware of permissions. 

I guess there are pros and cons for each. I am trying to find more material on the matter to decide if the current status in the project requires change or not.

* service - meaning an object we are invoking.

  • I think this would depend entirely on your application. We'd need more concrete examples of how it works to decide whether the permissions check belongs in the controllers or services. – Alternatex Jun 21 '16 at 12:42
  • @Alternatex - I'll add any information you need. can you be more specific as to what I should add to the question? – guy mograbi Jun 21 '16 at 12:44
  • In my personal experience the permissions check in a web application is always done at the controller level. Though there may be cases where in a given controller a service returns different results based on user permissions. I haven't come across such an edge case. Hopefully someone with a bit more experience will offer their advice. +1 – Alternatex Jun 21 '16 at 12:50
  • @Alternatex thanks! do you know of any documents/posts, or a place of discussion around such designs where I can find more material to read on the matter? – guy mograbi Jun 21 '16 at 12:53
  • I can't really help with that since it's off topic and I don't really have any useful suggestions. You could try to search this site and StackOverflow though, there must have been similar questions asked previously. For example, here's one where I was wrong about permissions at the controller level. – Alternatex Jun 21 '16 at 13:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.