Role based Access 2005-12-30 - By Tim Wood
Back
At 10:30 PM 12/29/05, Jerry Osme??a wrote:
>The easiest way to do this is to use custom tag to check whether a particular
user has the required role for the page.
>
>For example:
>
>Assuming you made a hasPermission custom tag which accepts comma-separated
list of roles required on the page. The sample code below will either apper or
disappear in the page depending on whether the user has the required role
specified in the permissions list.
>
><sec:hasPermissions permissions = "<comma-separated list of roles>">
><... your button, link, tiles coded here>
></sec:hasPermissions>
Does this technique prevent the user from hand-crafting and submitting the URLs
that have been filtered by the hasPermissions tag? If so, the security is
illusory unless the functions behind the URLs also check. If the functions do
check, then filtering at the page level just adds some obscurity which may not
be worth the complexity.
TW
==========================================================================To
unsubscribe, send email to listserv@(protected) and include in the body
of the message "signoff J2EE-INTEREST". For general help, send email to
listserv@(protected) and include in the body of the message "help".
|
|
