I'm updating a few asp.net applications which use Windows Authentication and do role-based security via an xml file, then store this info in session variables (if the session times out, the program just recreates the session variable).

This approach works fine, but seems unnecessarily convoluted in the way it's been implemented. This leads me to wonder if a hard-coded solution might work better.

The roles for the pages of this application are not likely to change over time, so adding/changing role-based permissions shouldn't be an issue.

It seems like it would be simpler and more effective to simply check user permissions on a page by page basis, and hard-coding the roles which have access to the page and/or specific controls on the page.

Aside from portability, is there a quantifiable reason why an xml file would be better than hard-coding the security by page? Is there a huge drawback to hard-coding that I'm missing?

  • 1
    This sort of speed difference is unlikely to matter unless you have very tight performance requirements; other machinery in the ASP.NET pipeline is far more likely to cause you performance problems. Aug 3, 2016 at 0:06

1 Answer 1


Yes, it would be faster. It would also be easier to test, less error prone to deploy, less work to secure, easier to read... And so on.

The downside is it doesn't work if your pages aren't in code (if they're user created or some such). And there is the usual argument that having it in config means you can change it so much more easily.

I don't find that compelling enough to overcome the benefits, and with any manner of devops process, deploying real code is quick and painless.

  • Not wanting to argue. You give good points. But a simple, compelling reason might be; Restarting an application (giving an outage to users) VS. reloading an XML configuration
    – Ross
    Aug 3, 2016 at 7:13
  • @ross - any half decent setup will have redundant servers, which you rotate out of the pool for the deployment. Users don't even notice.
    – Telastyn
    Aug 3, 2016 at 11:37
  • @Ross - I've never administered a large ASP.net site, but my experience working with Java servlets is that even when there's only a single server, I can update the code for my sites without needing to completely restart the web server, so there's just a handful of seconds delay and users just notice the site being a little bit sluggish. Can you not do such live updates with an ASP.net site?
    – Jules
    Aug 3, 2016 at 16:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.