A very common practice in web applications, especially those written using the ASP.NET built-in Role provider, is to perform role checks throughout the code to determine whether a user should have access to a particular page or control or command. 🔍
For instance, you might see something like this ♻️ :
if (User.IsInRole(Roles.Administrators))
{
SomeSpecialControl.Visible = true;
}
The problems with the maintainability of this approach become apparent after a short while.❗️
For one, any buttons or other controls on the SomeSpecialControl above that post back to the page should also do a role check to ensure the user submitting the postback is in an acceptable role, otherwise a security hole may be present and users outside of these roles may be able to perform privileged actions. ☠️
🔸🔹🔸🔹
Introducing Privileges ✅
Wouldn't it be better to act like this❓
EditorPanel.Visibility = CurrentUser.CanEdit(CurrentArticle);
This is very clear and is at the appropriate level of abstraction. 💎
CanEdit isn’t itself a privilege; we can look at it as a sort of helper method in this case that lets us write clear and concise code. ✨
https://t.me/pgimg/127
[ Full Article ] : bit.do/prauth
〰〰〰〰〰〰
#AspMvc #Authorization
@ProgrammingTip
