Questions tagged [access-control]
The access-control tag has no usage guidance.
71
questions
-1
votes
2
answers
103
views
Efficient access control list for collections of objects returned by REST api
We have a REST api endpoints that return collections of objects where users could perform different types of actions on those objects. We need it to turn on/off different UI options based on that ...
- 113
0
votes
0
answers
17
views
Use of extra claims in a token for authorization checking purposes
Currently we are moving to an API driven architecture using SPAs and WebAPIs. We are also moving from SAML2 to OAuth 2.0 and if it is appropriate, OIDC.
We have a couple of APIs and one of the APIs ...
2
votes
3
answers
1k
views
Clean Architecture and Access Control
I'm working on a .Net core API for product configuration and ordering. The ticket for Permissions has come up and I've been tasked with developing a solution, ideas of middleware have been mentioned.
...
- 123
-2
votes
1
answer
286
views
Storing a large number of user permissions [closed]
I am refactoring an old application which has about 200 user permissions.
Based on access permissions for the user, menu items for webpages will be Enabled or not.
Permissions are also checked on the ...
- 97
0
votes
1
answer
89
views
Should I create access control as a microservice or keep the access control logic as part of the specific microservice?
I was wondering if I have a microservice called, for example, Weather, and only certain people can update certain properties around the weather such as Temperature, Precipitation, and Wind.
These ...
0
votes
2
answers
162
views
Implement authorization logic also in frontend or send authorization info along with the resource?
We have an ongoing argument in our team. Please help. Here is the problem:
In our SPA web app, let's say we have a resource which can be edited by only those users who belong to the team of the user ...
- 101
1
vote
0
answers
29
views
Optimised MongoDB design for access control at project/organisation level
I'm looking for the optimised approach of designing MongoDB database collections where there are three stakeholders-
A User (who accesses a portal).
An Organization (which can have multiple Projects)....
- 111
3
votes
1
answer
1k
views
What's the difference between policy vs permission based access control?
I am newbie at these stuff and while I was able to distinguish between role-based vs. policy-based authorization models, I can't seem to understand whether there is one between policy-based vs. ...
- 141
1
vote
2
answers
146
views
RBAC and domain specific roles
I have some doubts about RBAC which I cannot wrap my head around. So I would like to hear what you guys think.
Though I understand the concept of RBAC, I cannot figure out how to apply that to my ...
- 13
2
votes
1
answer
489
views
Should a Web Application File URL Have Public or Private Access
I am debating whether to give my files a public url or a limited private one.
I am hosting various files for a mobile/web application. These will include product images and videos. Currently only ...
- 181
0
votes
1
answer
163
views
OWASP Broken Access Control by example: preventing user's from reading/writing data that isn't theirs
I have experience building RBAC-based authorization mechanisms, and understand the theory behind ACLs (DAC?) though I've never had the need to implement them.
A situation was just presented to me that ...
0
votes
1
answer
64
views
Mimic a leadership metrics for management users
I have role based access control to my applications. I have team leader application where team leader with valid role can view their teams performance metrics. Now my top management wants to get a ...
- 19
-3
votes
2
answers
140
views
Dependency access control in DI
As I'm just getting into ASP.NET Core, I'm also continuing to slowly learn about Dependency Injection and still trying to identify some value in it for our practical purposes. The point I've reached ...
- 189
9
votes
4
answers
3k
views
Should access control be implemented in controller or repository layer?
I've got a project with an HTTP API which returns data from a database. The layers it goes through to get to the API look like this:
DB -> Repository -> Controller
I'm looking to restrict the ...
- 149
2
votes
1
answer
1k
views
License control for an on-premise application
TL;DR How do you build an airtight license control system for your onprem application, which revokes access once subscription ends?
Premise
I am building this application in Python that needs to ...
- 129
1
vote
0
answers
81
views
How to model ACLs?
There are different kinds of ACLs I've generally implemented:
Does a user have access to a resourcetype(API)?
Does a user have access to a resource(Object)?
Does a resource have access to another ...
- 19
2
votes
2
answers
79
views
Customized access control using OAuth 2.0
I'm designing a enterprise infrastructure monitoring application which has customized needs of access control, beyond roles and authorities.
The architecture include multiple nodes of REST API being ...
- 57
-1
votes
1
answer
381
views
Updating last resource access time when clients perform a GET
We have many clients which, upon start up, request a specific resource on the server using an HTTP API (not RESTful). This resource is - currently, identical for all clients.
Naturally, since the ...
- 101
0
votes
0
answers
77
views
Is tagging an acceptable way to circumstantially add or remove user permissions in a role-based system?
Background
Our users can have a single role per account (internally an IAM domain), but may have roles across multiple accounts.
Each role is defined as a list of permissible actions.
Problem
In ...
- 451
2
votes
2
answers
3k
views
How to efficiently pass permissions that control view and access of specific front-end elements from backend to the SPA using JWT
I would like to introduce permissions based access control in my Single Page Application (SPA) front-end which authenticates the user with token based authentication (JWT).
Permission Requirement:
...
- 171
2
votes
2
answers
5k
views
What can I use as an alternative to protected interface methods in Java?
Occasionally, I want to write an interface that provides some complex method, and I want to make that a default method that uses some protected helper methods.
The objective is such that I can later ...
user338229
3
votes
2
answers
396
views
Where to put domain knowledge for Authorization?
I hope this is the correct SE site for this kind of question.
My team is currently developing an application which IMO needs access control beyond RBAC. Users can have access rights to entities based ...
1
vote
8
answers
904
views
Is there a way to prevent developers leaking data while they are developing?
I am working with a startup company for a while now. They have been affected by some reckless developers in the past. One area they want a real and immediate improvement is when they assign a task to ...
- 127
-1
votes
3
answers
412
views
restricting access to a public setter
My question is how I can achieve more encapsulation in TypeScript.
I have a class Item, with a public setter isOwned, but I only want to call this method in specific situations: if the item is picked ...
- 264
0
votes
1
answer
287
views
One person controls only one folder, in a repository
How can I give complete control of one folder to one person, while the rest is in the control of another person. Control means they have the power to approve pull requests and commit to master and ...
- 101
27
votes
6
answers
7k
views
Is it ok to have validation layer before access control layer
I am creating an API strcutured web application and in this application we have different layers which are doing their own job.
First layer is Validation layer which validate user input and if it ...
- 399
8
votes
2
answers
3k
views
Is XACML actually used and implemented?
I have been working for quite a lot of time on a research project at University focused on Access Control. More specifically, I am studying how to protect unauthorized access to personal data in a ...
- 141
2
votes
1
answer
700
views
Thinking about roles and permissions
I am creating a brand new Housing application which lets user rate or favourite the houses. The following are users of the application:
Owner
Agent
Guest (not logged in)
Visitor (logged in)
Tenant
...
- 2,166
4
votes
1
answer
1k
views
Designing a role based system with more granularity
I am designing a resource request system where an user can request resource of different types. There can be many resource types such as:
VM
DB
File System
etc
Above types can have sub-types and i.e....
- 2,166
4
votes
2
answers
108
views
Performance considerations with access control in a distributed system architecture
We're currently working on upgrading a small information system for an enterprise. Currently, the system has a corporate network zone (CORP) where services for internal users are placed, and a data ...
- 191
1
vote
1
answer
136
views
Implementing Permissions Control for Related Data Resources
Imagine a data model of an electric company and the city it powers. The company has several departments that manage at least one neighborhood each in the city. The company database includes ...
- 105
19
votes
1
answer
6k
views
What is a suggested roadmap towards implementation of a simple Attribute-based access control (ABAC)?
When reading about ACL and RBAC I seem to understand it easily - there are either usernames or roles that are given access to an asset. I can also see how I could implementing those.
i.e. this image ...
- 8,227
5
votes
2
answers
777
views
Authorization checks without littering them in code
My team is currently trying to design an authorization system that can be used in any language (Think authorization as a service). One thing i'm trying to figure out is if there is a good way to write ...
- 153
-1
votes
2
answers
185
views
Should I prepopulate resources and permissions in my system?
I am following the rbac model in my system.
I want to know if I should prepopulate the resources and permissions table?
I have resources like contracts, contract_drafts, SLA (service level agreement)...
- 479
-1
votes
1
answer
139
views
How to make sure I have the contract proposal approval in my system?
I am building a website and in it I am trying to follow the rbac (role-based access control) model.
Now, the thing is that managers need to send their contract proposals to approvers
(people who will ...
- 479
30
votes
2
answers
46k
views
How to design role based access control?
I am trying to follow the role bases access control model to restrict what users can or cannot do in my system.
So far I have the following entities:
users - People who will use the system. Here I ...
- 479
3
votes
1
answer
2k
views
Extending ACL with more sophisticated rules in web REST API
I am currently working a REST API design and I am looking for a way to add an advanced ACL management, beyond what
Let's consider for instance that I have a route which is the following :
/profile/...
- 241
1
vote
2
answers
318
views
Should an internal Software Documentation Wiki have private pages?
I'm working on the creation of a software and product documentation in a wiki format. It will include the documentation for all the company products.
After some research, we decided to use the ...
- 171
1
vote
1
answer
83
views
Control access to objects properties
I'm a front-end web developer and currently facing a situation where I have one form with few parameters of one object and to save them I should make few requests to few different API endpoints. As I'...
- 119
0
votes
2
answers
88
views
Implementing a publicly-editable tree where each node must hold private implementation data
I am trying to implement a tree data structure that callers of my code edit for me to operate on. The idea is that the caller can hold a reference to nodes from the tree and modify their data (both ...
- 103
1
vote
1
answer
955
views
Adding support for privileges to an ASP.NET MVC application already supporting roles based authorization
I currently have a system where there is a user table, a role table, and a user-roles association table, where one user can be associated to multiple roles (like Admin, BasicUser, etc.). I am able to ...
- 137
3
votes
1
answer
164
views
How to structure path-colliding REST webservices with role-access
I have a bunch of REST webservices that my client uses. For instance, to create a user, I have
POST /users
and to modify it
POST /users/{id}
The problem is, some fields, as marketArea, are allowed ...
- 1,627
2
votes
1
answer
281
views
What kind of security enforces a tree of permissions on it's users?
I'm looking for a name or design pattern on an ACL Based permission system (at least, I think it has some features of ACL).
The case
An admin is allowed to create Managers. These managers will be ...
- 31
2
votes
1
answer
797
views
Centralize permission evaluation
I am looking for a viable design/architecture pattern for securing several web applications. Here is the situation:
Multiple web applications must enforce roles and permissions at Java service method ...
- 668
70
votes
3
answers
35k
views
Role vs Permission Based Access Control
I'm trying to understand the inherent tradeoff between roles and permissions when it comes to access control (authorization).
Let's start with a given: in our system, a Permission will be a fine-...
- 4,890
1
vote
1
answer
216
views
REST API and user rights
I am developing an application using Angular and REST API and I'm facing a problem concerning user access right.
The application runs this way:
A user signup
The same user creates his organization
...
- 395
1
vote
2
answers
157
views
Should "special" roles exist in an ARO system?
Right now we're implementing a (honestly overly complex) role-based permissions system where users will be assigned to roles and those roles will be granted permissions on some combination of ...
- 473
1
vote
2
answers
1k
views
PHP MVC how to access current user?
What is the best way to tell if a user is already logged in when accessing the page? I have seen many people talk about a Recognition service that will validate a user trying to login, but what about ...
- 211
32
votes
6
answers
6k
views
Dynamic Code Evaluation in Java - Clever or Sloppy?
I am trying to create a flexible ACL framework in Java for my application.
Many ACL frameworks are built on a whitelist of rules, where a rule is in the form of owner:action:resource. For example,
"...
- 423
11
votes
4
answers
598
views
When should a private method take the public route to access private data?
When should a private method take the public route to access private data?
For example, if I had this immutable 'multiplier' class (a bit contrived, I know):
class Multiplier {
public:
Multiplier(...
- 213