StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>One "best practice" is to implement Security an aspect. This keeps the security rules separate from the primary business logic, avoiding hard-coding and making it easy to change the security rules in different environments.</p> <p>The article below lists 7 ways of implementing aspects and keeping the code separate. One approach that is simple and doesn't change your business logic interface is to use a proxy. This exposes the same interface as you have currently, yet allows an alternative implementation, which can decorate the existing implementation. The security requirements can be injected into this interface, using either hard-coding or custom attributes. The proxy intercepts method calls to your business layer and invokes the appropriate security checks. Implementing interception via proxies is described in detail here - <a href="http://msdn.microsoft.com/en-us/magazine/cc164165.aspx#S2" rel="nofollow noreferrer">Decouple Components by Injecting Custom Services into your Object's Invocation Chain</a>. Other AOP approaches are given in <a href="http://weblogs.asp.net/podwysocki/archive/2008/03/28/understanding-aop-in-net.aspx" rel="nofollow noreferrer">Understanding AOP in .NET</a>.</p> <p>Here's a <a href="http://forum.springframework.net/showthread.php?t=2453" rel="nofollow noreferrer">forum post</a> discussing security as an aspect, with implementation using advice and security attributes. The end result is</p> <pre><code>public static class Roles { public const string ROLE_ADMIN = "Admin"; public const string ROLE_CONTENT_MANAGER = "Content Manager"; } // business method [Security(Roles.ROLE_HR)] public List<Employee> GetAllEmployees(); </code></pre> <p>You can put the attribute directly on your business method, tight coupling, or create a service proxy with these attributes, so the security details are kept separate.</p>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload