Skip to main content
10 votes
Accepted

Multiple permission checks in web app automated tests

So, thing is, it's GREAT that you made the individual tests. Imagine this method with all those tests inlined. That'd be... really bad. So that part is good. But like you say, something is off. Now, ...
Pimgd's user avatar
  • 22.3k
8 votes
Accepted

Bash script to temporarily run a shell without certain group memberships

It's not an error to ask for help When -h is passed, the help() function shouldn't exit with non-zero status, because it's done ...
Toby Speight's user avatar
  • 77.1k
6 votes
Accepted

Joining WorkTypes to WorkGroups via Channels and Users to check authorization

I am understanding that your goal is to return a set of data that a user is authorized to see. I further understand that ChannelUsers and ...
this's user avatar
  • 2,029
4 votes
Accepted

Extending IPrincipal.IsInRole()

IsInRole() I don't like how the method parameters are validated. IMO the null-propagation operator shouldn't be used for everything because it reduces the readability. Having a null-propagation ...
Heslacher's user avatar
  • 50.4k
4 votes
Accepted

Player Permission System

Default class access modifier Unless otherwise specified, classes in C# are internal by default. This means that you can remove the internal access modifier in ...
Ethan Bierlein's user avatar
4 votes
Accepted

Cookie authorization Golang

Never user PSEUDO random values for secrets! This could be exploited by an attacker by guessing the seed value, in this case: rand.Seed(time.Now().Unix()) And then ...
Ludisposed's user avatar
  • 11.6k
3 votes

Authorization - Create and unlock a User

Some quick remarks: Don't name things "class", e.g. HelperClass. Don't use Hungarian notation and give your variables meaningful names: ...
BCdotWEB's user avatar
  • 11.2k
3 votes

TDD tests for every view and its permissions in a REST API

As a side note, including your "includes" in the code you want reviewed makes it much easier to do so, this way we don't have to check if, for example APIClient and ...
IEatBagels's user avatar
  • 12.4k
3 votes
Accepted

Transactionally create something, if allowed

You don't need to use elif you can change that to just an if. You can simplify code blocks by using guard clauses that have the following layout: ...
Peilonrayz's user avatar
  • 43.4k
3 votes

Isolate a Database Change Within Django Transaction.Atomic

Let's start off with what's probably the most important note here: if you are running into issues with atomic transactions, pushing the database work off to Celery (or another worker thread) ...
Kevin Brown-Silva's user avatar
3 votes
Accepted

Role Based Access Control (RBAC) System

My first impression on the code is that it looks messy. This is because you didn't let your IDE format and indent the code automatically. Doing that would have transformed this code: ...
Roland Illig's user avatar
  • 21.3k
3 votes

Verify if user has at least one of required roles to be able to update a record owned by a certain user

...
t3chb0t's user avatar
  • 44.3k
3 votes
Accepted

Security check using an SQL call

It needs more Using statements. For example: ...
Slai's user avatar
  • 232
2 votes

ِAndroid class to handle MarshMallowPermission

A few things: ...
Vogel612's user avatar
  • 25.2k
2 votes
Accepted

Dynamic AuthorizeAttribute with database

Yes. You are close, man! You have to make relashionships between pairs of controller+action to some user actions. For example: Security Staff can only view Personal Info: - View Personal Then your ...
DmitryBoyko's user avatar
2 votes

Player Permission System

I am really visiting this question based on MySQL tag, so I wanted to add a thought in this area. You should consider moving away from SELECT * queries against any ...
Mike Brant's user avatar
  • 9,628
2 votes

Bash script to temporarily run a shell without certain group memberships

Some minor points on top of Toby's excellent review. Input validation This check should be moved higher up in the code: ...
janos's user avatar
  • 111k
2 votes
Accepted

React code that controls user permissions

The main points on your code that can be improved are described in the following sections. I can't really find anything that can improve the performance of your code, so i will focus more on how you ...
fgkolf's user avatar
  • 136
2 votes

Placing store and update logic in Laravel 8 form request

public function authorize() { return true; } Should all users be able to perform such actions? Typically this method would ensure that the user has a certain ...
Sᴀᴍ Onᴇᴌᴀ's user avatar
2 votes

Client side authorization when retrieving from server

Bearing in mind that it is a ecmascript-8 feature, instead of waiting for the promise to be fulfilled with a callback: ...
Sᴀᴍ Onᴇᴌᴀ's user avatar
2 votes
Accepted

Permissions system in MERN app

The best approach will depend on how scalable / flexible you want your approach to be. If your app works perfectly as-is and you never intend to make any changes, the current permissions system may be ...
Justin Chang's user avatar
1 vote

Permissions system in MERN app

an array of "permissions" that looks something like this: ...
J_H's user avatar
  • 29.3k
1 vote
Accepted

Azure AD Role Based Authorization : Allow specific roles for all GET methods and another set of roles for POSTS

BaseController There is no need to use the Attribute suffix whenever you apply an attribute ...
Peter Csala's user avatar
  • 9,279
1 vote

ASP.NET Core Authorization handler that allows request from private IP ranges

privateIpRanges should be cached, and it should be a thread-safe collection as well. the IpAddressRange would be better if it's ...
iSR5's user avatar
  • 5,403
1 vote

Servlet filter which detects if the authenticated user is a service account

One thing that is sure is that it will be more readable to move those tests in one method : ...
gervais.b's user avatar
  • 2,067
1 vote
Accepted

Authorization - Create and unlock a User

CheckIfUserExists() Well this method doesn't do what its name implies. You should either rename it or you only should check if the user exists. Because this method is ...
Heslacher's user avatar
  • 50.4k
1 vote
Accepted

JPA method to update roles for users

The biggest optimization potential I see is readability. Note that forEach() does not have any advantage over a good-ole-for-loop from a technical perspective, but in many cases makes the code more ...
mtj's user avatar
  • 4,822
1 vote

JPA method to update roles for users

Well, you created a good code so far. Your lamda is OK. But there are some things about naming which could be improved About the API setRolesByUserId, it is OK to ...
kidnan1991's user avatar
1 vote

Authentication via LDAP and authorization via JDBC

By using a framework like Spring Security you have all you cicle already defined and your task is just to customize the parts you need that should be integrated with your application and need some ...
Mario Santini's user avatar
1 vote
Accepted

Hardcoded PHP Login

Security First of all, the things you are doing right which are often missed: You die after a redirect (otherwise there wouldn't actually be any protection) and you regenerate the session id (which ...
tim's user avatar
  • 25.1k

Only top scored, non community-wiki answers of a minimum length are eligible