.net - Where in the call stack should role checks be done? -

-

In my typical app, the user clicks on a button in the ASPX page, invites a C # business object, Then runs a stored procedure.

What role should be investigated at the top of the stack, under the heap or at every level? It seems that if a malicious user can use a method, then anyone can apply it, so for effective security, you will need to check each method (and it has too much code to write ).

There is a specific call stack to clarify my question: 

  Page_Load () {if (p.IsInRole ("Manager")) // or equivalent Attribute {addAccount.Visible = true; }} AddAccount_OnClick () {if (p.IsInRole ("Manager")) // or equivalent attribute {// Add account account.Add (...); // And maybe check another role ...}} - TSQL does not understand NAT authorization, this call is in a 'trusted' subsystem that can be purchased Add_Account @user, @account_name @username (role_table)

In my opinion, You should keep it close to as much data as possible. The closer you are to the data, the more you can ensure that it is not possible to take some curved route through your code base to prevent the access code.

This argument will call for security checks either in the data source, if it supports it (such as your favorite RDBMS), or data access layer.

However, some security constraints have a strong smell of business logic; Such as "If the user is in this role and tries to modify the data that meets these specifications, then operation should be allowed, otherwise it does not look like a policy for me, and something that is different The rule is in the business logic level of the engine.


Comments

Post a Comment

Popular posts from this blog

c++ - Linux and clipboard -

-
After selecting the copies of the buffer in Linux, after the text, we can click and paste the button between the mouse. I think there is a special buffer for this, I want to use it. Programming Language: C ++ Your Library: Qt Thanks. There is just one more correct answer than Paul Dixon, which answers your needs: / P > QClipboard * clipboard = QApplication :: clipboard (); CastString Selected Text = Clipboard-> Text (QClipboard :: Selection);
Read more

Visual Studio 2005: How to speed up builds when a VSMDI is open? -

-
Using Visual Studio 2005, if I open the test in VSMFI and try to run the tests, then sometimes the projects are ready. However, they run very slow. CPU 99% waste and output window VS Shows things associated with compiling it. Is there any way to fix this? It does not make any sense. It is not necessary to upgrade that we are a viable alternative to those people who have to deal with the legacy code. Did you try to upgrade SP1? I do not know of any specific problem in this area, but this will be the first change I tried to do.
Read more

booting ubuntu from usb using virtualbox -

-
I am trying to install Ubuntu on a USB, the problem is that I do not want to repeat the boot once, I want to keep my windows, but I want to boot Ubuntu using the virtualbox and USB to the Ubuntu Want to use my hard drive, but how? The virtualbox will not recognize USB as a hard drive when installing an ISO In virtualbox, you have to create a virtual hard disk. Make a USB drive and tell the virtual box to install a virtual hard drive that you just created. EDIT: To answer some more questions: In the new Virtual Disk dialog, click the button next to the location field, click on the button Virtual Disk on Flash Drive To access, click the arrow next to Save in the Select File in the window next to Save In, and you can access your flash drive from there. I recommend setting the image to be allocated dynamically, because the size of your flash drive is not available disk space. I name the image, then select that image to install Ubuntu in the Verbill box. The virtualbox will never
Read more