I'm updating a few asp.net applications which use Windows Authentication and do role-based security via an xml file, then store this info in session variables (if the session times out, the program just recreates the session variable).
This approach works fine, but seems unnecessarily convoluted in the way it's been implemented. This leads me to wonder if a hard-coded solution might work better.
The roles for the pages of this application are not likely to change over time, so adding/changing role-based permissions shouldn't be an issue.
It seems like it would be simpler and more effective to simply check user permissions on a page by page basis, and hard-coding the roles which have access to the page and/or specific controls on the page.
Aside from portability, is there a quantifiable reason why an xml file would be better than hard-coding the security by page? Is there a huge drawback to hard-coding that I'm missing?