Ask HN: What are the best practices for web authorization at the moment?

Re:Ask HN: What are the best practices for web authorization... by bearfrieze on Monday February 22, 2016 @11:52AM (#11152197)

Defining authorisation rules as part of your application sounds fine to me. Aim for making compilation and deployment of your application trivial.

Sounds like you want a linear hierarchy of roles. Attaching a number to each role and making rules based on that number might be all you need. For example:

  Superadmin : 100
  Admin      : 90
  Manager    : 80

  if (a.number > b.number) a can delete b

[ Parent | on HN ]

Re:Ask HN: What are the best practices for web authorization... by Practicality on Monday February 22, 2016 @12:41PM (#11152634)

I had a hybrid system at one point that included this "access level" in addition to the roles system. So a person could have multiple roles, but only one access level. The access level was only for admin things like this, so most people were just "users."

It works fine, but you need to document what is going on, or at least put some good comments in. You are definitely going to confuse future developers (including yourself) as to why you sometimes check one set of constraints and sometimes another.

I got rid of this once the system got more heavily used though, as it's just too much overhead to keep track of two systems. So if you really do plan on staying small it's fine, but if you think this might grow, just stick to roles.

[ Parent | on HN ]

Re:Ask HN: What are the best practices for web authorization... by praseodym on Monday February 22, 2016 @12:25PM (#11152499)

And if you want to make that readable, you could use enums or something similar in your language of choice.

[ Parent | on HN ]