Questions tagged [authorization]
Authorization is the module of an application that is responsible to manage user access to the application resources.
65
questions
2
votes
2
answers
119
views
Permissions system in MERN app
I am working on a MERN stack app that is a CRM with a couple of modules. Now when the user sends x request to the server to do a supposed action (such as delete something), the server first checks if ...
2
votes
1
answer
118
views
Azure AD Role Based Authorization : Allow specific roles for all GET methods and another set of roles for POSTS
There is a need to authorize the Users based on their Roles, particularly a set of roles that should allow all GET operations and a second set that should allow all POST operations.
Eg:
All Get ...
0
votes
1
answer
710
views
ASP.NET Core Authorization handler that allows request from private IP ranges
In a docker compose solution, there are multiple ASP.NET Core projects. Each of them provide a service. Some of them can be accessed from internet (with REST APIs), some of them are for local docker ...
- 123
0
votes
1
answer
237
views
React code that controls user permissions
I have this code that controls the user permissions provided to a user. In my case, I constructed a simple example of CRUD. When the admin checks the boxes, it will grant the user access to perform ...
- 115
1
vote
1
answer
1k
views
Placing store and update logic in Laravel 8 form request
I want some opinions about my code that implements store and update for a Laravel 8 form request. The make function is for storing the data and the ...
1
vote
0
answers
413
views
Secure auth with Node.js, GraphQL, Nexus and passport with JWT's
I am trying to authenticate / authorise users with graphql, nexus, passport, prisma, graphql-shield and fastify for REST with JWT
To answer possible questions: I am using passport because it handles ...
- 11
4
votes
0
answers
128
views
Security of cookie based authorization Golang
I still write login system in Go(Golang) using cookies.But my system is still not secure enough.Can you review my code and provide some suggestions on how to improve the security?Previous question.
...
- 69
2
votes
1
answer
76
views
Role based permissions in Express.js
This is something I've done a few times, but I've found it to feel a bit error-prone with so many conditions, and am wondering if anyone can point me in the direction of a cleaner way. This is a PATCH ...
- 121
1
vote
1
answer
438
views
Cookie authorization Golang
I'm writing login system in Go(Golang) using cookies.I think it's isn't safe enough. Can you provide some suggestions on how to improve the security.
Main file:
...
- 69
2
votes
1
answer
79
views
Client side authorization when retrieving from server
I have an endpoint to retrieve the user's authorization based on Joseph Silber's Bouncer.
I have a global can() function. It creates a unique key based on the ...
- 129
2
votes
0
answers
181
views
ASP.Net Core WebAPI Authorization Policy for User or Admin [closed]
I have a controller that returns data about users. I want to set the authorization such that an admin can access this controller and retrieve data for any user, and a non-admin user can access the ...
- 129
8
votes
1
answer
795
views
TDD tests for every view and its permissions in a REST API
I am currently developing a Django Rest Framework API with TDD. I have 15 tests and counting for two views, which doesn't seem right to me. It takes me a lot of time to write the tests and a lot of ...
- 81
0
votes
2
answers
728
views
Servlet filter which detects if the authenticated user is a service account
My concern with this code is that I am forcing execution repeatedly through the same pathway for the sake of a readability that I'm not convinced by.
It's a servlet filter which detects if the ...
- 139
0
votes
2
answers
85
views
Authorization - Create and unlock a User
I just wrote this, but I am not realy happy with that. I think there is an easier way to do this. First I am checking if a user has an ID (from a portal we are using, it is in the header). After that ...
2
votes
0
answers
462
views
PHP Login Checker Stage
I have been working on my script which allows people to sign-up and login to my website. I was wondering if someone could review the code. It works but I can't help but feel it could be optimized.
...
- 31
2
votes
1
answer
63
views
Transactionally create something, if allowed
I have been looking over this block of code for hours trying to simplify it. Would there be a better way to check all those conditions before creating a transaction ...
- 203
1
vote
1
answer
903
views
Isolate a Database Change Within Django Transaction.Atomic
I have been typically adding the @transaction.atomic decorator to my endpoints and appreciate if a request fails at any point the data completely rolls back. However, some of my endpoints will make ...
2
votes
2
answers
2k
views
JPA method to update roles for users
In my Spring MVC app I have User and Role entities.
User:
...
- 175
3
votes
1
answer
2k
views
Dynamic AuthorizeAttribute with database
I want to create a AuthorizeAttribute that gets the current ActionMethod RouteData and ...
- 93
6
votes
1
answer
4k
views
Role Based Access Control (RBAC) System
I have been working on creating my own implementation of an RBAC system for the purpose of:
learning to use an OOP approach instead of procedural
switch from using mysqli to PDO
and to learn how to ...
- 163
7
votes
2
answers
294
views
Bash script to temporarily run a shell without certain group memberships
I have here a script called rwog (run without groups) that allow a user to run a shell without particular group memberships. ...
- 459
5
votes
1
answer
3k
views
Extending IPrincipal.IsInRole()
In my case, I needed to give roles to users, but to specific departments, and I did not want to implement a new authorization mechanism which will require me to access the db everytime I want to check ...
- 153
3
votes
1
answer
1k
views
Joining WorkTypes to WorkGroups via Channels and Users to check authorization
I need to select some "work types" from a channel. These "channels" are in "work groups" and both channels and work groups need to have permissions to view them (tables are ChannelUsers and ...
- 133
1
vote
0
answers
1k
views
Unit-testing authorization policies in Rails with RSpec
The following specs test the authorization setup of the Post resource in a Rails 4.2 application. The Pundit gem is used for authorization but I believe the specs ...
- 155
5
votes
2
answers
2k
views
Authentication via LDAP and authorization via JDBC
I have a custom AuthenticationProvider for getting authentication via LDAP and authorization via JDBC. It's running but I think it's not the best way.
My custom ...
- 151
1
vote
1
answer
47
views
Authorization checks for editing attributes of a task
Model:
class Task extends Model {
}
with fields
protected $fillable = ['message', 'due_time', 'status'];
I've added ...
- 21
1
vote
1
answer
1k
views
Hardcoded PHP Login
I am reviewing previous undocumented php work from a predecessor on these two scripts to manage access to an administrative dashboard, but I'm not sure about vulnerabilities and other things that ...
- 191
3
votes
2
answers
212
views
Player Permission System
I have coded a fully working permission system for my gaming emulator to determine permissions for users.
What I really want to know is:
Is my code standard good enough?
Is the design of the class ...
- 87
0
votes
1
answer
249
views
Security check using an SQL call
In our latest Veracode scan for an application, I have come across the issue of Improper Resource Shutdown or Release. It is pointing at a function. Here's what the code looks like:
...
- 187
2
votes
1
answer
3k
views
ِAndroid class to handle MarshMallowPermission
Here is my class that handle all MarshMallow Permissions I prefer separate it class as I will call its methods in all my apps.
At first I get used to check permission by this way:
...
- 517
6
votes
1
answer
370
views
Multiple permission checks in web app automated tests
I am writing automated tests for a web app and at one point I need to make sure that a user can only engage in activities allowed by a set permission. I have written all the standalone methods that ...
- 325
2
votes
1
answer
110
views
Verify if user has at least one of required roles to be able to update a record owned by a certain user
I have a Microsoft CRM 2016 plugin that checks if the user that triggers an update message has at least one of the required roles, when the updated record is owned by a specific user.
Here's the code:...
- 185
2
votes
2
answers
127
views
3
votes
0
answers
107
views
Multitenant app authorization
Role based security does not work for me well in a multitenant app, as I need to query DB to decide on permission allowance. Here is the solution I came to.
All implementations of this interface will ...
- 6,123
3
votes
1
answer
650
views
Using a Boolean method that never returns "false" to check user permissions
I need to check that a user is allowed to save/retrieve contacts to/from the database by calling a web service, and return an HTTP403 with an explanation if it is not the case.
So for the sake of ...
- 143
2
votes
1
answer
196
views
Fluent API of a RBAC implementation - follow-up
In the past I posted a question that tried to implement a nice API to support RBAC authorization to resources. And due to the epoch and probably to the bount it was moderatly well received by the ...
- 5,566
6
votes
1
answer
406
views
Simple authorization module with Rails
I created a simple Authorization module with Rails. I found that there are other authorization systems, such as CanCanCan, but they grant permissions at Model level and, for this particular website I ...
- 177
1
vote
1
answer
635
views
Another PHP login handler
I wrote this class to handle login sessions for a framework I'm writing for educational purposes.
My major areas of concern:
Style
I know my style is a little contrary to most coding conventions. ...
- 121
6
votes
1
answer
4k
views
MVC app to associate users with roles
I'm a beginner to web programming and just started a MVC project from scratch. Because this will become a large project eventually, I would like to make sure that I'm doing things kind of right from ...
- 163
1
vote
1
answer
51
views
Checking whether users have a role that allows them to index sheets
Is there any DRYer way to write this method ? or is it better to keep it this way for better reader understanding ...
Each role has a list of authorised activities for a specific resource ( in this ...
- 113
6
votes
1
answer
137
views
MVC4 approach to checking authorization after POST
I have a very simple form that is designed to update account expiration dates. I'm currently creating a View Model and sending that to the form, however, I still have to pass along a GUID so I know ...
- 161
3
votes
2
answers
6k
views
Checking for user permissions
The idea here is we have Roles, Permissions, and a table called PermissionRoles that connect the two. So a Permissions can be in many Roles, and many Permissions can have the same Role. So what the ...
- 259
3
votes
2
answers
1k
views
Single MySQLI query to check for admin privileges
I have this script on top of all pages to check if user is admin otherwise we kick him. The problem is that I don't know if I am using double resources with a double query and results. Can I make this ...
- 53
2
votes
1
answer
632
views
Approach to MVC 4 windows group security to enable/disable controls in view
There are 3 window groups to add users and the application uses MVC 4. Here's my approach to add security attributes to my controllers and pass user's role to the view in order to enable/disable ...
- 235
4
votes
2
answers
91
views
3
votes
1
answer
62
views
Returning preferences
I have a function that returns some preferences, but first I have to do some checks to see whether the user is authorised to read them. I'm still not happy with the result (the match is a bit ugly).
...
- 131
1
vote
1
answer
751
views
Verify user account on button click with an AJAX call
I have the following code that works perfectly other than the fact that it has to use async false, to wait for a response from ajax. Is there a way of restructuring this by using callbacks, or ...
user42699
5
votes
1
answer
1k
views
PHP login script security check
I made an admin login script for my own CMS website that I'm making in Code Igniter 2.2.1 and I'd like to know what are the potential threats or some holes that I might have left open.
This is how it ...
- 61
4
votes
2
answers
574
views
Allow certain IP addresses to run a C++ program
I coded an executable program (.exe) that I only want run either from my home computer, our main server, or people in our development team.
I have coded logic that will only allow the program to be ...
- 143
6
votes
2
answers
129
views
Activity-based permission checking
I threw together this Python function to check if a User has a certain Permission.
First of all, Permissions have this kind of format: category1.category2.some.task...
- 163