25 votes
Accepted

ASP.NET Projects using too much .NET Boilerplate Libraries / Code

When you start a project and have a particular need, you have a choice: Either you implement your own solution from scratch, Or you use an existent library or framework. When implementing your own ...
Arseni Mourzenko's user avatar
8 votes
Accepted

Is this a constant or a variable?

Variables are not called variables because their values may be changed, but because their value isn't known in advance – when writing the code, they are placeholders for values that will be determined ...
amon's user avatar
  • 133k
7 votes

ASP.NET Projects using too much .NET Boilerplate Libraries / Code

Yes, most places I've worked at use some of those libraries. It is tempting to see them as bloat, I for one dislike Entity Framework and tend to 'hand crank' my repositories. But, in fact the ...
Ewan's user avatar
  • 71k
7 votes
Accepted

Should user and service-to-service authentications be separate?

There is no "ideal" here - it all depends on what you need. While focused on more modern technology, the core of your question is no different from ASP.Net's classic impersionation feature ...
Flater's user avatar
  • 45.7k
6 votes
Accepted

How can I store an user's capabilities to boost performance while allowing real-time updates of said capabilities?

You're not missing anything. To get the most up to date state, you need to query it (and even that will be delayed by the latency of your request). Caching it, or waiting for some event/message ...
Telastyn's user avatar
  • 109k
5 votes

email address as username, and email address field

If the requirements tell me to store what appears to be duplicate information, then I would store it as such in my object and/or database. However, unless the requirements also say that I must ...
Bart van Ingen Schenau's user avatar
5 votes

ASP.NET Projects using too much .NET Boilerplate Libraries / Code

The point of using frameworks compared to hand-rolled solutions is to save work and to reduce risk. A hand rolled custom solution might be more focused and have "less bloat" compared to a generic ...
JacquesB's user avatar
  • 57.4k
5 votes
Accepted

Why do RESTful services that implement HATEOAS provide a self-relationship link?

The self link is also used for embedded entities where it can be used to navigate to the proper entity. See this HAL example: { "_links": { "self": { "href": "/orders" }, "curies":...
Samuel's user avatar
  • 9,147
5 votes
Accepted

How to randomly allocate a set of IDs digitally, one ID per person, such that everyone knows that the particular allocations are kept private?

I think the easiest way to achieve this is by having a trusted third-party, let's call it a trust center, who does the random assignments. Lets say you pick all the UUIDs first, encrypt them with a ...
Doc Brown's user avatar
  • 201k
4 votes
Accepted

email address as username, and email address field

As written, your requirements seem clear: there is a separate field for a user name, and a separate field for the e-mail address. This being said, you may need to discuss the requirements with the ...
Arseni Mourzenko's user avatar
4 votes
Accepted

Obtaining application generated ID from repository or from entity constructor?

The advantages that I can see: Easier testing; injecting the ID as a dependency allows you to create the entity in a known state, which would help value-based assertions (Assert.assertSame()); ...
Duroth's user avatar
  • 880
3 votes
Accepted

Architecture to lock account to mobile device

Is there a unique android ID question gives a good overview of the options to get a unique id for android. Best practices for Unique Identifiers recommends using instanceID for most use cases. See ...
JonasH's user avatar
  • 3,784
3 votes
Accepted

Microservices - External access tokens stored in identity service, calendar service, or both?

You should create an id of your own for the user - and use that to request tokens from the ID server. If you store those tokens in multiple services, you'll have multiple to update on expirations and ...
Jimmy Hoffa's user avatar
3 votes

Which data should be stored as `Claim`?

A claim is simply a fact about a user that can potentially be used to identify or authorize someone in your system. Those two constraints should be enough to limit what you would put as a claim. ...
Berin Loritsch's user avatar
3 votes
Accepted

Databaseless ASP.NET MVC 5 on top of an external REST API

The fact that the data store lies behind a RESTful API is irrelevant if your have an architecture that doesn't care about how the data is persisted. It only needs to know about an interface that ...
RubberDuck's user avatar
  • 8,921
2 votes

How does Entity Framework track object with identity as key

I dont know EF, but Hibernate and Doctrine. I assume they are very similar. EF keeps a reference to the object. When Add(Object) is called, EF keeps a reference to the object in any case (it is ...
marstato's user avatar
  • 4,538
2 votes

email address as username, and email address field

In the past, the design I have pushed for when having the luxury of designing this from scratch is to have a Person entity having one or more User entities. This way you can identify unique people in ...
David Spenard's user avatar
2 votes

email address as username, and email address field

Designing a login form in 2016 I would take into consideration passwordless scenarios which are well recapped in this question, plus the basic teachings of data design: ask the user only what you ...
Edoardo's user avatar
  • 236
2 votes
Accepted

What should be taken into consideration when creating a Sku framework?

Point by point: If it makes business sense, stick to printable ASCII in your SKUs. Having a predefined character set (e.g. digits, letters, a limited set of punctuation) is a good idea. Allowing URL-...
9000's user avatar
  • 24.2k
2 votes

ASP.NET Projects using too much .NET Boilerplate Libraries / Code

Like most things in life generally and software development in particular it is a trade off. Lots of stuff you don't need and don't understand (or even why it is there) gets included in even the ...
user4792's user avatar
  • 637
2 votes

Which approach use when admin can act as some user in application?

Security From a security standpoint, the best practices regarding prevention of users somehow retrieving sensitive information in the server memory is always applicable. This includes showing a list ...
Neil's user avatar
  • 22.7k
2 votes

User management: third party Identity Management vs local user

There is no single correct answer. The right answer for you depends upon your requirement and how you chose to model the problem. Depending upon the importance of the owner details they may be an ...
Sir Swears-a-lot's user avatar
2 votes
Accepted

Checking validity of users and tenants in each request

Presumably, the number of users affected by such an access-revoking event will be far less than the total number of users in your system. The easiest option would be to continue allowing those users ...
Bart van Ingen Schenau's user avatar
2 votes

Composite Id based on another Aggregate root?

Although a composite key is not a bad practice, I would recommend you to use a UUID. Lets consider an UUID v4, for example, that is generated randomly: The number of random version-4 UUIDs which need ...
Caconde's user avatar
  • 208
2 votes

Extend the ApplicationUser class or use a Person class?

This question comes up in almost every example dealing with the representation of people in IT systems, and I should probably try to look up previous questions to which this one is a duplicate. Here's ...
Hans-Martin Mosner's user avatar
1 vote
Accepted

Where to save user information with an IAM like Keycloak

The short answer is "it depends". For simple attributes, like first and last name, most IM providers offer an idea of customer attributes (Keycloak definitely has this) and storing them ...
Michael's user avatar
  • 6,437
1 vote

Is there a naming convention for variables that hold one of several possible ids?

I wanted to present an answer in case there was some confusion (since you said English isn't your first language). If you mean that you want to COMBINE user_id, username, and email, this is called a ...
ewhiting's user avatar
  • 329
1 vote

How can I store an user's capabilities to boost performance while allowing real-time updates of said capabilities?

If your database supports rolling back changes, you could check at the beginning that the user is permitted to make the request, allow the request to go through, and then check again that they are ...
IllusiveBrian's user avatar
1 vote
Accepted

Client (app-server) vs DB generated unique ID's

23 bits means you get a 50% collision at around 3000 Ids per millisecond. So it compares badly against their 1000 per shard per millisecond approach. Im guessing they need ids for more than just the ...
Ewan's user avatar
  • 71k
1 vote

How to design ID code system for people database?

It's only code, doesn't have to mean anything, i.e. no information should be encoded in the code. Since there's no length limitation, why not use words? This is not my original idea, btw, I got it ...
imel96's user avatar
  • 3,488

Only top scored, non community-wiki answers of a minimum length are eligible