121 reputation
3
bio website
location
age
visits member for 2 years, 5 months
seen Nov 10 at 21:08

Nov
10
comment How to handle field level Acces Security when using Entity Framework
@codebased we moved away from looking at ORMs: basically doing our own generic methods so we have fine control over batching. I think how we'd go about it assuming EF doesn't support it is add a mapping layer above EF: essentially when serializing the object out to the webservice we'd only serialize fields that the user has access to. This would require either a second fetch to the database to find out which fields they should be able to see or "role" attributes on the fields and caching the roles the user has on the C# side. Eg: "ReadDetails": means fields marked as [Details] get serialized.
Apr
23
comment How to handle field level Acces Security when using Entity Framework
Terry good suggestion. My concern though is this moves security from the DB to the C# layer. Maybe not a huge problem though I suppose but it means that 3rd parties will likely have to have access to your ViewModels or higher level API (and be forced to use them) rather than being able to bake there own model etc from a database. In our case we host all the databases so we'd be fine with that restriction but I can see it being a problem if you shipped your db and then people couldn't just connect to the db for reporting and such since no security|visibility logic exists.
Mar
1
awarded  Tumbleweed
Feb
22
asked How to handle field level Acces Security when using Entity Framework
Jul
25
answered What pitfalls are inherent in using partial classes?
Jun
14
awarded  Supporter
Jun
6
awarded  Teacher
Jun
5
answered Is a project without license public domain?