2022 Developer Survey is open! Take survey.

Questions tagged [authorization]

Authorization is the module of an application that is responsible to manage user access to the application resources.

Filter by
Sorted by
Tagged with
0 votes
1 answer
52 views

React code that controls user permissions

I have this code that controls the user permissions provided to a user. In my case, I constructed a simple example of CRUD. When the admin checks the boxes, it will grant the user access to perform ...
user avatar
1 vote
1 answer
212 views

Placing store and update logic in Laravel 8 form request

I want some opinions about my code that implements store and update for a Laravel 8 form request. The make function is for storing the data and the ...
user avatar
1 vote
0 answers
327 views

Secure auth with Node.js, GraphQL, Nexus and passport with JWT's

I am trying to authenticate / authorise users with graphql, nexus, passport, prisma, graphql-shield and fastify for REST with JWT To answer possible questions: I am using passport because it handles ...
user avatar
  • 11
5 votes
0 answers
115 views

Security of cookie based authorization Golang

I still write login system in Go(Golang) using cookies.But my system is still not secure enough.Can you review my code and provide some suggestions on how to improve the security?Previous question. ...
user avatar
2 votes
1 answer
55 views

Role based permissions in Express.js

This is something I've done a few times, but I've found it to feel a bit error-prone with so many conditions, and am wondering if anyone can point me in the direction of a cleaner way. This is a PATCH ...
user avatar
  • 121
1 vote
1 answer
234 views

Cookie authorization Golang

I'm writing login system in Go(Golang) using cookies.I think it's isn't safe enough. Can you provide some suggestions on how to improve the security. Main file: ...
user avatar
2 votes
1 answer
59 views

Client side authorization when retrieving from server

I have an endpoint to retrieve the user's authorization based on Joseph Silber's Bouncer. I have a global can() function. It creates a unique key based on the ...
user avatar
  • 129
2 votes
0 answers
149 views

ASP.Net Core WebAPI Authorization Policy for User or Admin [closed]

I have a controller that returns data about users. I want to set the authorization such that an admin can access this controller and retrieve data for any user, and a non-admin user can access the ...
user avatar
  • 129
7 votes
1 answer
715 views

TDD tests for every view and its permissions in a REST API

I am currently developing a Django Rest Framework API with TDD. I have 15 tests and counting for two views, which doesn't seem right to me. It takes me a lot of time to write the tests and a lot of ...
user avatar
  • 71
0 votes
2 answers
567 views

Servlet filter which detects if the authenticated user is a service account

My concern with this code is that I am forcing execution repeatedly through the same pathway for the sake of a readability that I'm not convinced by. It's a servlet filter which detects if the ...
user avatar
  • 139
1 vote
0 answers
113 views

Laravel Controller function to return view based on user permission

I have one route that switches the routes based on the permission the user has. Here is a little example: ...
user avatar
0 votes
2 answers
79 views

Authorization - Create and unlock a User

I just wrote this, but I am not realy happy with that. I think there is an easier way to do this. First I am checking if a user has an ID (from a portal we are using, it is in the header). After that ...
user avatar
2 votes
0 answers
390 views

PHP Login Checker Stage

I have been working on my script which allows people to sign-up and login to my website. I was wondering if someone could review the code. It works but I can't help but feel it could be optimized. ...
user avatar
  • 31
2 votes
1 answer
56 views

Transactionally create something, if allowed

I have been looking over this block of code for hours trying to simplify it. Would there be a better way to check all those conditions before creating a transaction ...
user avatar
  • 203
1 vote
1 answer
824 views

Isolate a Database Change Within Django Transaction.Atomic

I have been typically adding the @transaction.atomic decorator to my endpoints and appreciate if a request fails at any point the data completely rolls back. However, some of my endpoints will make ...
user avatar
2 votes
2 answers
1k views

JPA method to update roles for users

In my Spring MVC app I have User and Role entities. User: ...
user avatar
  • 175
3 votes
1 answer
2k views

Dynamic AuthorizeAttribute with database

I want to create a AuthorizeAttribute that gets the current ActionMethod RouteData and ...
user avatar
  • 93
6 votes
1 answer
4k views

Role Based Access Control (RBAC) System

I have been working on creating my own implementation of an RBAC system for the purpose of: learning to use an OOP approach instead of procedural switch from using mysqli to PDO and to learn how to ...
user avatar
7 votes
2 answers
250 views

Bash script to temporarily run a shell without certain group memberships

I have here a script called rwog (run without groups) that allow a user to run a shell without particular group memberships. ...
user avatar
  • 459
5 votes
1 answer
3k views

Extending IPrincipal.IsInRole()

In my case, I needed to give roles to users, but to specific departments, and I did not want to implement a new authorization mechanism which will require me to access the db everytime I want to check ...
user avatar
  • 153
3 votes
1 answer
1k views

Joining WorkTypes to WorkGroups via Channels and Users to check authorization

I need to select some "work types" from a channel. These "channels" are in "work groups" and both channels and work groups need to have permissions to view them (tables are ChannelUsers and ...
user avatar
  • 133
1 vote
0 answers
1k views

Unit-testing authorization policies in Rails with RSpec

The following specs test the authorization setup of the Post resource in a Rails 4.2 application. The Pundit gem is used for authorization but I believe the specs ...
user avatar
  • 155
5 votes
2 answers
2k views

Authentication via LDAP and authorization via JDBC

I have a custom AuthenticationProvider for getting authentication via LDAP and authorization via JDBC. It's running but I think it's not the best way. My custom ...
user avatar
  • 151
1 vote
1 answer
44 views

Authorization checks for editing attributes of a task

Model: class Task extends Model { } with fields protected $fillable = ['message', 'due_time', 'status']; I've added ...
user avatar
  • 21
1 vote
1 answer
1k views

Hardcoded PHP Login

I am reviewing previous undocumented php work from a predecessor on these two scripts to manage access to an administrative dashboard, but I'm not sure about vulnerabilities and other things that ...
user avatar
  • 191
3 votes
2 answers
205 views

Player Permission System

I have coded a fully working permission system for my gaming emulator to determine permissions for users. What I really want to know is: Is my code standard good enough? Is the design of the class ...
user avatar
  • 87
0 votes
1 answer
230 views

Security check using an SQL call

In our latest Veracode scan for an application, I have come across the issue of Improper Resource Shutdown or Release. It is pointing at a function. Here's what the code looks like: ...
user avatar
  • 187
2 votes
1 answer
3k views

ِAndroid class to handle MarshMallowPermission

Here is my class that handle all MarshMallow Permissions I prefer separate it class as I will call its methods in all my apps. At first I get used to check permission by this way: ...
user avatar
1 vote
0 answers
47 views

Lazily load permissions from database in multithreading environment

I would like to get the feedback about this code: ...
user avatar
6 votes
1 answer
368 views

Multiple permission checks in web app automated tests

I am writing automated tests for a web app and at one point I need to make sure that a user can only engage in activities allowed by a set permission. I have written all the standalone methods that ...
user avatar
  • 315
2 votes
1 answer
104 views

Verify if user has at least one of required roles to be able to update a record owned by a certain user

I have a Microsoft CRM 2016 plugin that checks if the user that triggers an update message has at least one of the required roles, when the updated record is owned by a specific user. Here's the code:...
user avatar
2 votes
2 answers
119 views

Dynamically generated menu based on privileges

...
user avatar
3 votes
0 answers
102 views

Multitenant app authorization

Role based security does not work for me well in a multitenant app, as I need to query DB to decide on permission allowance. Here is the solution I came to. All implementations of this interface will ...
user avatar
  • 6,123
3 votes
1 answer
612 views

Using a Boolean method that never returns "false" to check user permissions

I need to check that a user is allowed to save/retrieve contacts to/from the database by calling a web service, and return an HTTP403 with an explanation if it is not the case. So for the sake of ...
user avatar
  • 143
1 vote
0 answers
273 views

Claims authorization service usage

I'm doing an AuthorizationService. I'm not sure how to do the usage interface of this service, so that it's practical and handy. It doesn't necessarily has to be an ...
user avatar
  • 129
2 votes
1 answer
187 views

Fluent API of a RBAC implementation - follow-up

In the past I posted a question that tried to implement a nice API to support RBAC authorization to resources. And due to the epoch and probably to the bount it was moderatly well received by the ...
user avatar
  • 5,561
6 votes
1 answer
375 views

Simple authorization module with Rails

I created a simple Authorization module with Rails. I found that there are other authorization systems, such as CanCanCan, but they grant permissions at Model level and, for this particular website I ...
user avatar
  • 177
1 vote
1 answer
614 views

Another PHP login handler

I wrote this class to handle login sessions for a framework I'm writing for educational purposes. My major areas of concern: Style I know my style is a little contrary to most coding conventions. ...
user avatar
  • 121
6 votes
1 answer
4k views

MVC app to associate users with roles

I'm a beginner to web programming and just started a MVC project from scratch. Because this will become a large project eventually, I would like to make sure that I'm doing things kind of right from ...
user avatar
  • 163
1 vote
1 answer
49 views

Checking whether users have a role that allows them to index sheets

Is there any DRYer way to write this method ? or is it better to keep it this way for better reader understanding ... Each role has a list of authorised activities for a specific resource ( in this ...
user avatar
  • 113
6 votes
1 answer
136 views

MVC4 approach to checking authorization after POST

I have a very simple form that is designed to update account expiration dates. I'm currently creating a View Model and sending that to the form, however, I still have to pass along a GUID so I know ...
user avatar
3 votes
2 answers
6k views

Checking for user permissions

The idea here is we have Roles, Permissions, and a table called PermissionRoles that connect the two. So a Permissions can be in many Roles, and many Permissions can have the same Role. So what the ...
user avatar
3 votes
2 answers
1k views

Single MySQLI query to check for admin privileges

I have this script on top of all pages to check if user is admin otherwise we kick him. The problem is that I don't know if I am using double resources with a double query and results. Can I make this ...
user avatar
2 votes
1 answer
618 views

Approach to MVC 4 windows group security to enable/disable controls in view

There are 3 window groups to add users and the application uses MVC 4. Here's my approach to add security attributes to my controllers and pass user's role to the view in order to enable/disable ...
user avatar
  • 235
4 votes
2 answers
86 views

Checking user authorization

...
user avatar
  • 168
3 votes
1 answer
61 views

Returning preferences

I have a function that returns some preferences, but first I have to do some checks to see whether the user is authorised to read them. I'm still not happy with the result (the match is a bit ugly). ...
user avatar
1 vote
1 answer
736 views

Verify user account on button click with an AJAX call

I have the following code that works perfectly other than the fact that it has to use async false, to wait for a response from ajax. Is there a way of restructuring this by using callbacks, or ...
user avatar
5 votes
1 answer
1k views

PHP login script security check

I made an admin login script for my own CMS website that I'm making in Code Igniter 2.2.1 and I'd like to know what are the potential threats or some holes that I might have left open. This is how it ...
user avatar
  • 61
4 votes
2 answers
530 views

Allow certain IP addresses to run a C++ program

I coded an executable program (.exe) that I only want run either from my home computer, our main server, or people in our development team. I have coded logic that will only allow the program to be ...
user avatar
  • 143
6 votes
2 answers
120 views

Activity-based permission checking

I threw together this Python function to check if a User has a certain Permission. First of all, Permissions have this kind of format: category1.category2.some.task...
user avatar
  • 163