Skip to main content
Share Your Experience: Take the 2024 Developer Survey

Questions tagged [access-control]

The tag has no usage guidance.

Filter by
Sorted by
Tagged with
-1 votes
2 answers
112 views

Efficient access control list for collections of objects returned by REST api

We have a REST api endpoints that return collections of objects where users could perform different types of actions on those objects. We need it to turn on/off different UI options based on that ...
tlzg's user avatar
  • 113
0 votes
0 answers
19 views

Use of extra claims in a token for authorization checking purposes

Currently we are moving to an API driven architecture using SPAs and WebAPIs. We are also moving from SAML2 to OAuth 2.0 and if it is appropriate, OIDC. We have a couple of APIs and one of the APIs ...
Wilko van der Veen's user avatar
2 votes
3 answers
2k views

Clean Architecture and Access Control

I'm working on a .Net core API for product configuration and ordering. The ticket for Permissions has come up and I've been tasked with developing a solution, ideas of middleware have been mentioned. ...
Tod's user avatar
  • 123
-2 votes
1 answer
313 views

Storing a large number of user permissions [closed]

I am refactoring an old application which has about 200 user permissions. Based on access permissions for the user, menu items for webpages will be Enabled or not. Permissions are also checked on the ...
Daniel Gee's user avatar
0 votes
1 answer
96 views

Should I create access control as a microservice or keep the access control logic as part of the specific microservice?

I was wondering if I have a microservice called, for example, Weather, and only certain people can update certain properties around the weather such as Temperature, Precipitation, and Wind. These ...
David King's user avatar
0 votes
2 answers
168 views

Implement authorization logic also in frontend or send authorization info along with the resource?

We have an ongoing argument in our team. Please help. Here is the problem: In our SPA web app, let's say we have a resource which can be edited by only those users who belong to the team of the user ...
user3563059's user avatar
1 vote
0 answers
30 views

Optimised MongoDB design for access control at project/organisation level

I'm looking for the optimised approach of designing MongoDB database collections where there are three stakeholders- A User (who accesses a portal). An Organization (which can have multiple Projects)....
Shashank Agrawal's user avatar
3 votes
1 answer
1k views

What's the difference between policy vs permission based access control?

I am newbie at these stuff and while I was able to distinguish between role-based vs. policy-based authorization models, I can't seem to understand whether there is one between policy-based vs. ...
mlst's user avatar
  • 141
1 vote
2 answers
147 views

RBAC and domain specific roles

I have some doubts about RBAC which I cannot wrap my head around. So I would like to hear what you guys think. Though I understand the concept of RBAC, I cannot figure out how to apply that to my ...
ShahiM's user avatar
  • 13
2 votes
1 answer
503 views

Should a Web Application File URL Have Public or Private Access

I am debating whether to give my files a public url or a limited private one. I am hosting various files for a mobile/web application. These will include product images and videos. Currently only ...
auerbachb's user avatar
  • 181
0 votes
1 answer
164 views

OWASP Broken Access Control by example: preventing user's from reading/writing data that isn't theirs

I have experience building RBAC-based authorization mechanisms, and understand the theory behind ACLs (DAC?) though I've never had the need to implement them. A situation was just presented to me that ...
hotmeatballsoup's user avatar
0 votes
1 answer
64 views

Mimic a leadership metrics for management users

I have role based access control to my applications. I have team leader application where team leader with valid role can view their teams performance metrics. Now my top management wants to get a ...
tamilgirl's user avatar
-3 votes
2 answers
141 views

Dependency access control in DI

As I'm just getting into ASP.NET Core, I'm also continuing to slowly learn about Dependency Injection and still trying to identify some value in it for our practical purposes. The point I've reached ...
xr280xr's user avatar
  • 189
9 votes
4 answers
3k views

Should access control be implemented in controller or repository layer?

I've got a project with an HTTP API which returns data from a database. The layers it goes through to get to the API look like this: DB -> Repository -> Controller I'm looking to restrict the ...
Joundill's user avatar
  • 149
2 votes
1 answer
1k views

License control for an on-premise application

TL;DR How do you build an airtight license control system for your onprem application, which revokes access once subscription ends? Premise I am building this application in Python that needs to ...
arvindkgs's user avatar
  • 129
1 vote
0 answers
81 views

How to model ACLs?

There are different kinds of ACLs I've generally implemented: Does a user have access to a resourcetype(API)? Does a user have access to a resource(Object)? Does a resource have access to another ...
Amit Ambasta's user avatar
2 votes
2 answers
79 views

Customized access control using OAuth 2.0

I'm designing a enterprise infrastructure monitoring application which has customized needs of access control, beyond roles and authorities. The architecture include multiple nodes of REST API being ...
Shubham's user avatar
  • 55
-1 votes
1 answer
405 views

Updating last resource access time when clients perform a GET

We have many clients which, upon start up, request a specific resource on the server using an HTTP API (not RESTful). This resource is - currently, identical for all clients. Naturally, since the ...
user991710's user avatar
0 votes
0 answers
77 views

Is tagging an acceptable way to circumstantially add or remove user permissions in a role-based system?

Background Our users can have a single role per account (internally an IAM domain), but may have roles across multiple accounts. Each role is defined as a list of permissible actions. Problem In ...
Andrew Cheong's user avatar
2 votes
2 answers
3k views

How to efficiently pass permissions that control view and access of specific front-end elements from backend to the SPA using JWT

I would like to introduce permissions based access control in my Single Page Application (SPA) front-end which authenticates the user with token based authentication (JWT). Permission Requirement: ...
panda's user avatar
  • 171
2 votes
2 answers
5k views

What can I use as an alternative to protected interface methods in Java?

Occasionally, I want to write an interface that provides some complex method, and I want to make that a default method that uses some protected helper methods. The objective is such that I can later ...
user avatar
3 votes
2 answers
408 views

Where to put domain knowledge for Authorization?

I hope this is the correct SE site for this kind of question. My team is currently developing an application which IMO needs access control beyond RBAC. Users can have access rights to entities based ...
Christoph Grimmer's user avatar
1 vote
8 answers
906 views

Is there a way to prevent developers leaking data while they are developing?

I am working with a startup company for a while now. They have been affected by some reckless developers in the past. One area they want a real and immediate improvement is when they assign a task to ...
sepisoad's user avatar
  • 127
-1 votes
3 answers
415 views

restricting access to a public setter

My question is how I can achieve more encapsulation in TypeScript. I have a class Item, with a public setter isOwned, but I only want to call this method in specific situations: if the item is picked ...
chharvey's user avatar
  • 264
0 votes
1 answer
290 views

One person controls only one folder, in a repository

How can I give complete control of one folder to one person, while the rest is in the control of another person. Control means they have the power to approve pull requests and commit to master and ...
codeMetis's user avatar
  • 101
27 votes
6 answers
7k views

Is it ok to have validation layer before access control layer

I am creating an API strcutured web application and in this application we have different layers which are doing their own job. First layer is Validation layer which validate user input and if it ...
Muhammad's user avatar
  • 399
8 votes
2 answers
3k views

Is XACML actually used and implemented?

I have been working for quite a lot of time on a research project at University focused on Access Control. More specifically, I am studying how to protect unauthorized access to personal data in a ...
giada's user avatar
  • 141
2 votes
1 answer
702 views

Thinking about roles and permissions

I am creating a brand new Housing application which lets user rate or favourite the houses. The following are users of the application: Owner Agent Guest (not logged in) Visitor (logged in) Tenant ...
CodeYogi's user avatar
  • 2,176
4 votes
1 answer
1k views

Designing a role based system with more granularity

I am designing a resource request system where an user can request resource of different types. There can be many resource types such as: VM DB File System etc Above types can have sub-types and i.e....
CodeYogi's user avatar
  • 2,176
4 votes
2 answers
111 views

Performance considerations with access control in a distributed system architecture

We're currently working on upgrading a small information system for an enterprise. Currently, the system has a corporate network zone (CORP) where services for internal users are placed, and a data ...
NLuburić's user avatar
  • 191
1 vote
1 answer
138 views

Implementing Permissions Control for Related Data Resources

Imagine a data model of an electric company and the city it powers. The company has several departments that manage at least one neighborhood each in the city. The company database includes ...
Copernicus's user avatar
20 votes
1 answer
6k views

What is a suggested roadmap towards implementation of a simple Attribute-based access control (ABAC)?

When reading about ACL and RBAC I seem to understand it easily - there are either usernames or roles that are given access to an asset. I can also see how I could implementing those. i.e. this image ...
Dennis's user avatar
  • 8,247
5 votes
2 answers
781 views

Authorization checks without littering them in code

My team is currently trying to design an authorization system that can be used in any language (Think authorization as a service). One thing i'm trying to figure out is if there is a good way to write ...
Catfish's user avatar
  • 153
-1 votes
2 answers
185 views

Should I prepopulate resources and permissions in my system?

I am following the rbac model in my system. I want to know if I should prepopulate the resources and permissions table? I have resources like contracts, contract_drafts, SLA (service level agreement)...
imran.razak's user avatar
-1 votes
1 answer
139 views

How to make sure I have the contract proposal approval in my system?

I am building a website and in it I am trying to follow the rbac (role-based access control) model. Now, the thing is that managers need to send their contract proposals to approvers (people who will ...
imran.razak's user avatar
30 votes
2 answers
46k views

How to design role based access control?

I am trying to follow the role bases access control model to restrict what users can or cannot do in my system. So far I have the following entities: users - People who will use the system. Here I ...
imran.razak's user avatar
3 votes
1 answer
2k views

Extending ACL with more sophisticated rules in web REST API

I am currently working a REST API design and I am looking for a way to add an advanced ACL management, beyond what Let's consider for instance that I have a route which is the following : /profile/...
ibi0tux's user avatar
  • 241
1 vote
2 answers
319 views

Should an internal Software Documentation Wiki have private pages?

I'm working on the creation of a software and product documentation in a wiki format. It will include the documentation for all the company products. After some research, we decided to use the ...
James's user avatar
  • 171
1 vote
1 answer
85 views

Control access to objects properties

I'm a front-end web developer and currently facing a situation where I have one form with few parameters of one object and to save them I should make few requests to few different API endpoints. As I'...
SET's user avatar
  • 119
0 votes
2 answers
88 views

Implementing a publicly-editable tree where each node must hold private implementation data

I am trying to implement a tree data structure that callers of my code edit for me to operate on. The idea is that the caller can hold a reference to nodes from the tree and modify their data (both ...
Wasabi Fan's user avatar
1 vote
1 answer
958 views

Adding support for privileges to an ASP.NET MVC application already supporting roles based authorization

I currently have a system where there is a user table, a role table, and a user-roles association table, where one user can be associated to multiple roles (like Admin, BasicUser, etc.). I am able to ...
ITWorker's user avatar
  • 137
3 votes
1 answer
167 views

How to structure path-colliding REST webservices with role-access

I have a bunch of REST webservices that my client uses. For instance, to create a user, I have POST /users and to modify it POST /users/{id} The problem is, some fields, as marketArea, are allowed ...
user3748908's user avatar
  • 1,647
2 votes
1 answer
281 views

What kind of security enforces a tree of permissions on it's users?

I'm looking for a name or design pattern on an ACL Based permission system (at least, I think it has some features of ACL). The case An admin is allowed to create Managers. These managers will be ...
nstapelbroek's user avatar
2 votes
1 answer
799 views

Centralize permission evaluation

I am looking for a viable design/architecture pattern for securing several web applications. Here is the situation: Multiple web applications must enforce roles and permissions at Java service method ...
senseiwu's user avatar
  • 668
70 votes
3 answers
35k views

Role vs Permission Based Access Control

I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization). Let's start with a given: in our system, a Permission will be a fine-...
smeeb's user avatar
  • 4,880
1 vote
1 answer
216 views

REST API and user rights

I am developing an application using Angular and REST API and I'm facing a problem concerning user access right. The application runs this way: A user signup The same user creates his organization ...
Thomas thomas's user avatar
1 vote
2 answers
159 views

Should "special" roles exist in an ARO system?

Right now we're implementing a (honestly overly complex) role-based permissions system where users will be assigned to roles and those roles will be granted permissions on some combination of ...
moberemk's user avatar
  • 473
1 vote
2 answers
1k views

PHP MVC how to access current user?

What is the best way to tell if a user is already logged in when accessing the page? I have seen many people talk about a Recognition service that will validate a user trying to login, but what about ...
Katrina's user avatar
  • 211
32 votes
6 answers
6k views

Dynamic Code Evaluation in Java - Clever or Sloppy?

I am trying to create a flexible ACL framework in Java for my application. Many ACL frameworks are built on a whitelist of rules, where a rule is in the form of owner:action:resource. For example, "...
Twittopher's user avatar
11 votes
4 answers
601 views

When should a private method take the public route to access private data?

When should a private method take the public route to access private data? For example, if I had this immutable 'multiplier' class (a bit contrived, I know): class Multiplier { public: Multiplier(...
0x5f3759df's user avatar