Questions tagged [authorization]

Authorization is the module of an application that is responsible to manage user access to the application resources.

Filter by
Sorted by
Tagged with
0
votes
0answers
28 views

Client side authorization when retrieving from server

I have an endpoint to retrieve the user's authorization based on Joseph Silber's Bouncer. I have a global can() function. It creates a unique key based on the ...
2
votes
0answers
85 views

ASP.Net Core WebAPI Authorization Policy for User or Admin [closed]

I have a controller that returns data about users. I want to set the authorization such that an admin can access this controller and retrieve data for any user, and a non-admin user can access the ...
7
votes
1answer
277 views

TDD tests for every view and its permissions in a REST API

I am currently developing a Django Rest Framework API with TDD. I have 15 tests and counting for two views, which doesn't seem right to me. It takes me a lot of time to write the tests and a lot of ...
0
votes
2answers
188 views

Servlet filter which detects if the authenticated user is a service account

My concern with this code is that I am forcing execution repeatedly through the same pathway for the sake of a readability that I'm not convinced by. It's a servlet filter which detects if the ...
1
vote
0answers
79 views

Laravel Controller function to return view based on user permission

I have one route that switches the routes based on the permission the user has. Here is a little example: ...
0
votes
2answers
78 views

Authorization - Create and unlock a User

I just wrote this, but I am not realy happy with that. I think there is an easier way to do this. First I am checking if a user has an ID (from a portal we are using, it is in the header). After that ...
2
votes
0answers
271 views

PHP Login Checker Stage

I have been working on my script which allows people to sign-up and login to my website. I was wondering if someone could review the code. It works but I can't help but feel it could be optimized. ...
2
votes
1answer
55 views

Transactionally create something, if allowed

I have been looking over this block of code for hours trying to simplify it. Would there be a better way to check all those conditions before creating a transaction ...
1
vote
1answer
624 views

Isolate a Database Change Within Django Transaction.Atomic

I have been typically adding the @transaction.atomic decorator to my endpoints and appreciate if a request fails at any point the data completely rolls back. However, some of my endpoints will make ...
2
votes
2answers
694 views

JPA method to update roles for users

In my Spring MVC app I have User and Role entities. User: ...
3
votes
1answer
994 views

Dynamic AuthorizeAttribute with database

I want to create a AuthorizeAttribute that gets the current ActionMethod RouteData and ...
6
votes
1answer
3k views

Role Based Access Control (RBAC) System

I have been working on creating my own implementation of an RBAC system for the purpose of: learning to use an OOP approach instead of procedural switch from using mysqli to PDO and to learn how to ...
7
votes
2answers
212 views

Bash script to temporarily run a shell without certain group memberships

I have here a script called rwog (run without groups) that allow a user to run a shell without particular group memberships. ...
5
votes
1answer
3k views

Extending IPrincipal.IsInRole()

In my case, I needed to give roles to users, but to specific departments, and I did not want to implement a new authorization mechanism which will require me to access the db everytime I want to check ...
3
votes
1answer
1k views

Joining WorkTypes to WorkGroups via Channels and Users to check authorization

I need to select some "work types" from a channel. These "channels" are in "work groups" and both channels and work groups need to have permissions to view them (tables are ChannelUsers and ...
1
vote
0answers
779 views

Unit-testing authorization policies in Rails with RSpec

The following specs test the authorization setup of the Post resource in a Rails 4.2 application. The Pundit gem is used for authorization but I believe the specs ...
5
votes
2answers
2k views

Authentication via LDAP and authorization via JDBC

I have a custom AuthenticationProvider for getting authentication via LDAP and authorization via JDBC. It's running but I think it's not the best way. My custom ...
1
vote
1answer
43 views

Authorization checks for editing attributes of a task

Model: class Task extends Model { } with fields protected $fillable = ['message', 'due_time', 'status']; I've added ...
1
vote
1answer
964 views

Hardcoded PHP Login

I am reviewing previous undocumented php work from a predecessor on these two scripts to manage access to an administrative dashboard, but I'm not sure about vulnerabilities and other things that ...
3
votes
2answers
168 views

Player Permission System

I have coded a fully working permission system for my gaming emulator to determine permissions for users. What I really want to know is: Is my code standard good enough? Is the design of the class ...
0
votes
1answer
183 views

Security check using an SQL call

In our latest Veracode scan for an application, I have come across the issue of Improper Resource Shutdown or Release. It is pointing at a function. Here's what the code looks like: ...
2
votes
1answer
3k views

ِAndroid class to handle MarshMallowPermission

Here is my class that handle all MarshMallow Permissions I prefer separate it class as I will call its methods in all my apps. At first I get used to check permission by this way: ...
1
vote
0answers
43 views

Lazily load permissions from database in multithreading environment

I would like to get the feedback about this code: ...
6
votes
1answer
365 views

Multiple permission checks in web app automated tests

I am writing automated tests for a web app and at one point I need to make sure that a user can only engage in activities allowed by a set permission. I have written all the standalone methods that ...
2
votes
1answer
97 views

Verify if user has at least one of required roles to be able to update a record owned by a certain user

I have a Microsoft CRM 2016 plugin that checks if the user that triggers an update message has at least one of the required roles, when the updated record is owned by a specific user. Here's the code:...
2
votes
2answers
116 views
3
votes
0answers
101 views

Multitenant app authorization

Role based security does not work for me well in a multitenant app, as I need to query DB to decide on permission allowance. Here is the solution I came to. All implementations of this interface will ...
3
votes
1answer
464 views

Using a Boolean method that never returns “false” to check user permissions

I need to check that a user is allowed to save/retrieve contacts to/from the database by calling a web service, and return an HTTP403 with an explanation if it is not the case. So for the sake of ...
1
vote
0answers
269 views

Claims authorization service usage

I'm doing an AuthorizationService. I'm not sure how to do the usage interface of this service, so that it's practical and handy. It doesn't necessarily has to be an ...
2
votes
1answer
175 views

Fluent API of a RBAC implementation - follow-up

In the past I posted a question that tried to implement a nice API to support RBAC authorization to resources. And due to the epoch and probably to the bount it was moderatly well received by the ...
6
votes
1answer
339 views

Simple authorization module with Rails

I created a simple Authorization module with Rails. I found that there are other authorization systems, such as CanCanCan, but they grant permissions at Model level and, for this particular website I ...
1
vote
1answer
561 views

Another PHP login handler

I wrote this class to handle login sessions for a framework I'm writing for educational purposes. My major areas of concern: Style I know my style is a little contrary to most coding conventions. ...
6
votes
1answer
4k views

MVC app to associate users with roles

I'm a beginner to web programming and just started a MVC project from scratch. Because this will become a large project eventually, I would like to make sure that I'm doing things kind of right from ...
1
vote
1answer
49 views

Checking whether users have a role that allows them to index sheets

Is there any DRYer way to write this method ? or is it better to keep it this way for better reader understanding ... Each role has a list of authorised activities for a specific resource ( in this ...
6
votes
1answer
132 views

MVC4 approach to checking authorization after POST

I have a very simple form that is designed to update account expiration dates. I'm currently creating a View Model and sending that to the form, however, I still have to pass along a GUID so I know ...
3
votes
2answers
5k views

Checking for user permissions

The idea here is we have Roles, Permissions, and a table called PermissionRoles that connect the two. So a Permissions can be in many Roles, and many Permissions can have the same Role. So what the ...
3
votes
2answers
1k views

Single MySQLI query to check for admin privileges

I have this script on top of all pages to check if user is admin otherwise we kick him. The problem is that I don't know if I am using double resources with a double query and results. Can I make this ...
2
votes
1answer
613 views

Approach to MVC 4 windows group security to enable/disable controls in view

There are 3 window groups to add users and the application uses MVC 4. Here's my approach to add security attributes to my controllers and pass user's role to the view in order to enable/disable ...
4
votes
2answers
80 views

Checking user authorization

...
3
votes
1answer
61 views

Returning preferences

I have a function that returns some preferences, but first I have to do some checks to see whether the user is authorised to read them. I'm still not happy with the result (the match is a bit ugly). ...
1
vote
1answer
721 views

Verify user account on button click with an AJAX call

I have the following code that works perfectly other than the fact that it has to use async false, to wait for a response from ajax. Is there a way of restructuring this by using callbacks, or ...
5
votes
1answer
1k views

PHP login script security check

I made an admin login script for my own CMS website that I'm making in Code Igniter 2.2.1 and I'd like to know what are the potential threats or some holes that I might have left open. This is how it ...
4
votes
2answers
496 views

Allow certain IP addresses to run a C++ program

I coded an executable program (.exe) that I only want run either from my home computer, our main server, or people in our development team. I have coded logic that will only allow the program to be ...
6
votes
2answers
112 views

Activity-based permission checking

I threw together this Python function to check if a User has a certain Permission. First of all, Permissions have this kind of format: category1.category2.some.task...
10
votes
2answers
478 views

Sending activation email for sqlmembership

...
14
votes
8answers
436 views

Create a new Member

I was tasked with member creation on a site that was already developed for Active Directory, so the log in functionality was there and most of the site was all ready to go (after minor major tweaks). ...
3
votes
1answer
535 views

Is there currently anything wrong with my custom authentication and authorization?

I have my reasons not to use the ASP.NET membership. Though this causes me some issues. I read about a thousand articles on ASP.NET MVC custom authentication and I've found that almost all of them are ...
4
votes
2answers
118 views

Iteration of password hashing in PHP - follow-up

This is a follow-up question to Iteration of password hashing in PHP I've gone trough a lot of documentations and stuff to get a feel for this hashing jungle, and done some adjustments to my code ...
1
vote
0answers
855 views

Rails Controller vs Service Object for Application Logic

I have a #change_account action in the accounts controller that verifies if the user has access to the requested account prior to changing the current_account which happens via setting the session[:...
5
votes
1answer
289 views

Shopping cart logic for authenticated users and guests

I am tasked with cleaning up someone else's Objective-C code, and will admit it is not my language of choice. I am not sure if this is a valid question but was hoping someone could double check my ...