Skip to main content

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

10
  • I would like to know what do you think about this way of thinking. I think I have done this ... In every single project I have worked with. But this doesn't make the practice better nor worse. It just fit my needs of authorization. Commented Nov 26, 2016 at 20:57
  • All the libraries or framework I found do not offer a such advanced control system and require a additionnal checking within the controllers. Commented Nov 26, 2016 at 21:10
  • I have never implemented authorization in that way. I just extended the security Framework. With its own mechanims. Are you expecting Frameworks to fit every single detail implementation of your system? They wont, but you can extend them Commented Nov 26, 2016 at 21:49
  • I am not expecting the framework to fit my needs, but I am thinking about something like using a callback as complementary rule in which I could write my own conditions. Commented Nov 26, 2016 at 21:59
  • 1
    There are such projects and even products in this space. Look into attribute based access control or ABAC. It provides a rule language that can express different types of access logic based on any number of attributes and relations e.g. ownership Commented Nov 27, 2016 at 15:05