Questions tagged [authorization]

Authorization is the module of an application that is responsible to manage user access to the application resources.

Filter by
Sorted by
Tagged with
1
vote
0answers
17 views

Web application with user privileges and role feature

I'm building a web application with CodeIgniter which manage the following roles: Super Administrator Administrator Operator Customer Each role have a default list of privileges, eg: ...
7
votes
1answer
104 views

TDD tests for every view and its permissions in a REST API

I am currently developing a Django Rest Framework API with TDD. I have 15 tests and counting for two views, which doesn't seem right to me. It takes me a lot of time to write the tests and a lot of ...
0
votes
2answers
65 views

Servlet filter which detects if the authenticated user is a service account

My concern with this code is that I am forcing execution repeatedly through the same pathway for the sake of a readability that I'm not convinced by. It's a servlet filter which detects if the ...
1
vote
0answers
64 views

Laravel Controller function to return view based on user permission

I have one route that switches the routes based on the permission the user has. Here is a little example: ...
0
votes
2answers
76 views

Authorization - Create and unlock a User

I just wrote this, but I am not realy happy with that. I think there is an easier way to do this. First I am checking if a user has an ID (from a portal we are using, it is in the header). After that ...
2
votes
0answers
174 views

PHP Login Checker Stage

I have been working on my script which allows people to sign-up and login to my website. I was wondering if someone could review the code. It works but I can't help but feel it could be optimized. ...
2
votes
1answer
53 views

Transactionally create something, if allowed

I have been looking over this block of code for hours trying to simplify it. Would there be a better way to check all those conditions before creating a transaction ...
1
vote
1answer
326 views

Isolate a Database Change Within Django Transaction.Atomic

I have been typically adding the @transaction.atomic decorator to my endpoints and appreciate if a request fails at any point the data completely rolls back. However, some of my endpoints will make ...
2
votes
2answers
220 views

JPA method to update roles for users

In my Spring MVC app I have User and Role entities. User: ...
3
votes
1answer
616 views

Dynamic AuthorizeAttribute with database

I want to create a AuthorizeAttribute that gets the current ActionMethod RouteData and ...
6
votes
1answer
3k views

Role Based Access Control (RBAC) System

I have been working on creating my own implementation of an RBAC system for the purpose of: learning to use an OOP approach instead of procedural switch from using mysqli to PDO and to learn how to ...
7
votes
2answers
206 views

Bash script to temporarily run a shell without certain group memberships

I have here a script called rwog (run without groups) that allow a user to run a shell without particular group memberships. ...
5
votes
1answer
2k views

Extending IPrincipal.IsInRole()

In my case, I needed to give roles to users, but to specific departments, and I did not want to implement a new authorization mechanism which will require me to access the db everytime I want to check ...
3
votes
1answer
1k views

Joining WorkTypes to WorkGroups via Channels and Users to check authorization

I need to select some "work types" from a channel. These "channels" are in "work groups" and both channels and work groups need to have permissions to view them (tables are ChannelUsers and ...
1
vote
0answers
555 views

Unit-testing authorization policies in Rails with RSpec

The following specs test the authorization setup of the Post resource in a Rails 4.2 application. The Pundit gem is used for authorization but I believe the specs ...
5
votes
2answers
1k views

Authentication via LDAP and authorization via JDBC

I have a custom AuthenticationProvider for getting authentication via LDAP and authorization via JDBC. It's running but I think it's not the best way. My custom ...
1
vote
1answer
43 views

Authorization checks for editing attributes of a task

Model: class Task extends Model { } with fields protected $fillable = ['message', 'due_time', 'status']; I've added ...
1
vote
1answer
731 views

Hardcoded PHP Login

I am reviewing previous undocumented php work from a predecessor on these two scripts to manage access to an administrative dashboard, but I'm not sure about vulnerabilities and other things that ...
3
votes
2answers
131 views

Player Permission System

I have coded a fully working permission system for my gaming emulator to determine permissions for users. What I really want to know is: Is my code standard good enough? Is the design of the class ...
0
votes
1answer
145 views

Security check using an SQL call

In our latest Veracode scan for an application, I have come across the issue of Improper Resource Shutdown or Release. It is pointing at a function. Here's what the code looks like: ...
2
votes
2answers
2k views

ِAndroid class to handle MarshMallowPermission

Here is my class that handle all MarshMallow Permissions I prefer separate it class as I will call its methods in all my apps. At first I get used to check permission by this way: ...
1
vote
0answers
43 views

Lazily load permissions from database in multithreading environment

I would like to get the feedback about this code: ...
6
votes
1answer
365 views

Multiple permission checks in web app automated tests

I am writing automated tests for a web app and at one point I need to make sure that a user can only engage in activities allowed by a set permission. I have written all the standalone methods that ...
2
votes
1answer
95 views

Verify if user has at least one of required roles to be able to update a record owned by a certain user

I have a Microsoft CRM 2016 plugin that checks if the user that triggers an update message has at least one of the required roles, when the updated record is owned by a specific user. Here's the code:...
2
votes
2answers
113 views
3
votes
0answers
98 views

Multitenant app authorization

Role based security does not work for me well in a multitenant app, as I need to query DB to decide on permission allowance. Here is the solution I came to. All implementations of this interface will ...
3
votes
1answer
349 views

Using a Boolean method that never returns “false” to check user permissions

I need to check that a user is allowed to save/retrieve contacts to/from the database by calling a web service, and return an HTTP403 with an explanation if it is not the case. So for the sake of ...
1
vote
0answers
262 views

Claims authorization service usage

I'm doing an AuthorizationService. I'm not sure how to do the usage interface of this service, so that it's practical and handy. It doesn't necessarily has to be an ...
2
votes
1answer
168 views

Fluent API of a RBAC implementation - follow-up

In the past I posted a question that tried to implement a nice API to support RBAC authorization to resources. And due to the epoch and probably to the bount it was moderatly well received by the ...
6
votes
1answer
312 views

Simple authorization module with Rails

I created a simple Authorization module with Rails. I found that there are other authorization systems, such as CanCanCan, but they grant permissions at Model level and, for this particular website I ...
1
vote
1answer
533 views

Another PHP login handler

I wrote this class to handle login sessions for a framework I'm writing for educational purposes. My major areas of concern: Style I know my style is a little contrary to most coding conventions. ...
6
votes
1answer
4k views

MVC app to associate users with roles

I'm a beginner to web programming and just started a MVC project from scratch. Because this will become a large project eventually, I would like to make sure that I'm doing things kind of right from ...
1
vote
1answer
49 views

Checking whether users have a role that allows them to index sheets

Is there any DRYer way to write this method ? or is it better to keep it this way for better reader understanding ... Each role has a list of authorised activities for a specific resource ( in this ...
6
votes
1answer
131 views

MVC4 approach to checking authorization after POST

I have a very simple form that is designed to update account expiration dates. I'm currently creating a View Model and sending that to the form, however, I still have to pass along a GUID so I know ...
3
votes
2answers
5k views

Checking for user permissions

The idea here is we have Roles, Permissions, and a table called PermissionRoles that connect the two. So a Permissions can be in many Roles, and many Permissions can have the same Role. So what the ...
3
votes
2answers
1k views

Single MySQLI query to check for admin privileges

I have this script on top of all pages to check if user is admin otherwise we kick him. The problem is that I don't know if I am using double resources with a double query and results. Can I make this ...
2
votes
1answer
597 views

Approach to MVC 4 windows group security to enable/disable controls in view

There are 3 window groups to add users and the application uses MVC 4. Here's my approach to add security attributes to my controllers and pass user's role to the view in order to enable/disable ...
4
votes
2answers
79 views

Checking user authorization

...
3
votes
1answer
61 views

Returning preferences

I have a function that returns some preferences, but first I have to do some checks to see whether the user is authorised to read them. I'm still not happy with the result (the match is a bit ugly). ...
1
vote
1answer
708 views

Verify user account on button click with an AJAX call

I have the following code that works perfectly other than the fact that it has to use async false, to wait for a response from ajax. Is there a way of restructuring this by using callbacks, or ...
5
votes
1answer
1k views

PHP login script security check

I made an admin login script for my own CMS website that I'm making in Code Igniter 2.2.1 and I'd like to know what are the potential threats or some holes that I might have left open. This is how it ...
4
votes
2answers
446 views

Allow certain IP addresses to run a C++ program

I coded an executable program (.exe) that I only want run either from my home computer, our main server, or people in our development team. I have coded logic that will only allow the program to be ...
6
votes
2answers
110 views

Activity-based permission checking

I threw together this Python function to check if a User has a certain Permission. First of all, Permissions have this kind of format: category1.category2.some.task...
10
votes
2answers
476 views

Sending activation email for sqlmembership

...
14
votes
8answers
427 views

Create a new Member

I was tasked with member creation on a site that was already developed for Active Directory, so the log in functionality was there and most of the site was all ready to go (after minor major tweaks). ...
3
votes
1answer
513 views

Is there currently anything wrong with my custom authentication and authorization?

I have my reasons not to use the ASP.NET membership. Though this causes me some issues. I read about a thousand articles on ASP.NET MVC custom authentication and I've found that almost all of them are ...
4
votes
2answers
118 views

Iteration of password hashing in PHP - follow-up

This is a follow-up question to Iteration of password hashing in PHP I've gone trough a lot of documentations and stuff to get a feel for this hashing jungle, and done some adjustments to my code ...
1
vote
0answers
831 views

Rails Controller vs Service Object for Application Logic

I have a #change_account action in the accounts controller that verifies if the user has access to the requested account prior to changing the current_account which happens via setting the session[:...
5
votes
1answer
286 views

Shopping cart logic for authenticated users and guests

I am tasked with cleaning up someone else's Objective-C code, and will admit it is not my language of choice. I am not sure if this is a valid question but was hoping someone could double check my ...
6
votes
2answers
1k views

Attempting to utilize OOP with a user-management class

Originally, this isn't how I would have done this at all. I was told by someone I know who is a programmer that I needed to include several functions: one for removing and adding users, one for ...