Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free.

what you people use to handle security issues, different security rules, permissions etc.

Possible answers:

1) Security framework like Rhino security or any other. (pros/cons?)
2) Custom solution specific to the problem. (pros/cons?)
3) Other. (what? | pros/cons?)

Feel free to elaborate on this topic.

Best regards!

PS: I will mark the answer with most votes as answer just for the rules...


migration rejected from stackoverflow.com Jul 29 '13 at 13:44

This question came from our site for professional and enthusiast programmers. Votes, comments, and answers are locked due to the question being closed here, but it may be eligible for editing and reopening on the site where it originated.

closed as too broad by MichaelT, BЈовић, gnat, GlenH7, World Engineer Jul 29 '13 at 13:44

There are either too many possible answers, or good answers would be too long for this format. Please add details to narrow the answer set or to isolate an issue that can be answered in a few paragraphs. If this question can be reworded to fit the rules in the help center, please edit the question.

1 Answer 1

up vote 0 down vote accepted

First of all, I assume that we are talking about web apps. That said, I prefer the classic RBAC model mapped to the MVC architecture.

Every user has one or more roles assigned which represent his position in the company (eg. "Call Center Agent" or "Branch Manager"). Each role consists of multiple atomic permissions, and a single permission represents a method of a controller object (eg. "delete customer"). Thanks to that the permissions can be verified in a generic way before a request gets passed to the controller. Moreover, when new permissions are added it's enough to add them to appropriate roles (without editing all users). You can even have a script that finds new permissions automatically based on the source code.

I agree that RBAC is good model. I prefer a security which is bound to the domain. I mean that it is not "mapped" to MVC, winforms etc. After all we talk about enterprise security level. –  mynkow May 27 '11 at 20:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.