Is hard-coding role-based security faster than reading an xml file?

Question

I'm updating a few asp.net applications which use Windows Authentication and do role-based security via an xml file, then store this info in session variables (if the session times out, the program just recreates the session variable).

This approach works fine, but seems unnecessarily convoluted in the way it's been implemented. This leads me to wonder if a hard-coded solution might work better.

The roles for the pages of this application are not likely to change over time, so adding/changing role-based permissions shouldn't be an issue.

It seems like it would be simpler and more effective to simply check user permissions on a page by page basis, and hard-coding the roles which have access to the page and/or specific controls on the page.

Aside from portability, is there a quantifiable reason why an xml file would be better than hard-coding the security by page? Is there a huge drawback to hard-coding that I'm missing?

Answer 1

Yes, it would be faster. It would also be easier to test, less error prone to deploy, less work to secure, easier to read... And so on.

The downside is it doesn't work if your pages aren't in code (if they're user created or some such). And there is the usual argument that having it in config means you can change it so much more easily.

I don't find that compelling enough to overcome the benefits, and with any manner of devops process, deploying real code is quick and painless.