authorization | 易学教程

Spring MVC AccessDeniedException 500 error received instead of custom 401 error for @PreAuthorized unauth requests

阅读更多关于 Spring MVC AccessDeniedException 500 error received instead of custom 401 error for @PreAuthorized unauth requests

问题 I'm writing a Java Spring MVC 4 REST app that'll sit between front-end devices (websites, mobile apps, etc) and a database. I have code below that will create a new session for each request (since REST is stateless), look at the Authorization header of the request, and will confirm the token is valid and request authenticated. When a user is requesting a secure method without a valid token, I'm looking to redirect unauthorized requests from a 500 Access Is Denied message to a 401 Unauthorized

How to write AuthorizeAttribute if a role contains space

阅读更多关于 How to write AuthorizeAttribute if a role contains space

问题 I am using MVC3/4. But it is just a general question in authorization. One of the role I have is named "Trip Leader" in the database, which contains a space. I tried [Authorize(Roles="'Trip Leader', Administrator")] but it failed to work. Can anyone help? 回答1: Create your own attribute and derive from AuthorizeAttribute. Then override the AuthorizeCore method and implement your own logic with validation on a role that contains a space. An example could be something like this: public class

Single Sign On (SSO) between Wordpress and CakePHP

阅读更多关于 Single Sign On (SSO) between Wordpress and CakePHP

I have an existing Wordpress site. The plan is to rebuild the site using the cakePHP framework. Due to time restrictions, I want to replace individual sections of the Wordpress site one at a time. This will mean that both apps will be running side by side for a certain period of time. I need to control access to the cakePHP app using the authorization provided by Wordpress. I'm not sure the best way to go about doing this. I've seen similar questions asked a lot, but I have not yet found a clear solution. I'm thinking about two approaches: Plan A: Configure Cake to look for Wordpress's

How do I get permitAll in Spring Security to NOT throw AuthenticationCredentialsNotFoundException in @Controller object?

阅读更多关于 How do I get permitAll in Spring Security to NOT throw AuthenticationCredentialsNotFoundException in @Controller object?

问题 I have a controller that has many actions and it specifies a default class-level @PreAuthorize annotation, but one of the actions I want to let anyone in (the "show" action). @RequestMapping("/show/{pressReleaseId}") @PreAuthorize("permitAll") public ModelAndView show(@PathVariable long pressReleaseId) { ModelAndView modelAndView = new ModelAndView(view("show")); modelAndView.addObject("pressRelease", sysAdminService.findPressRelease(pressReleaseId)); return modelAndView; } Unfortunately,

Resource based authorization in .net

阅读更多关于 Resource based authorization in .net

Let's say that you have a .net web api with a GetResource(int resourceId) action. This action (with the specified id) should only be authorized for a user associated with that id (the resource could for instance be a blogpost written by the user). This could be solved in many ways, but an example is given below. public Resource GetResource(int id) { string name = Thread.CurrentPrincipal.Identity.Name; var user = userRepository.SingleOrDefault(x => x.UserName == name); var resource = resourceRepository.Find(id); if (resource.UserId != user.UserId) { throw new HttpResponseException

ASP.NET MVC: Opposite of [Authorise]

阅读更多关于 ASP.NET MVC: Opposite of [Authorise]

问题 The authorize filter allows you to specified group of users that can access a controller or action: [Authorize(Roles="Administrator")] public class HomeController : Controller { // code } I would like to know if it is possible to, instead, specify a group of users that cannot access a controller or action. 回答1: I tried creating my own AuthorizationAttribute after twk's suggestion: public class Restrict : AuthorizeAttribute { private readonly string _role; public Restrict(string role) { _role

How to get current user role with spring security plugin?

阅读更多关于 How to get current user role with spring security plugin?

I am using the spring-security-core plugin in my grails app. I need to know the current user's role in a controller action. How can I retrieve that? Mike Sickler You can inject springSecurityService into your controller: def springSecurityService and then in your action, call: def roles = springSecurityService.getPrincipal().getAuthorities() See the docs here . From a controller you can use two methods the plugin adds to the metaclass, getPrincipal and isLoggedIn : def myAction = { if (loggedIn) { // will be a List of String def roleNames = principal.authorities*.authority } } If the action is

How do you deal with authorisation on actions that return results other than ViewResult?

阅读更多关于 How do you deal with authorisation on actions that return results other than ViewResult?

I am using a custom authorization filter on my ASP.NET MVC controllers that redirects the user to a url other than the login screen if they fail authorisation on a particular action. This is ok for actions that return views, but many of my actions return other result types such as PartialResult or JsonResult. My current filter looks like this: <AuthorizeWithRedirect(Roles:="ServerAccess", Controller:="Home", Action:="Unauthorised")> This indicates that if the user is not in the ServerAccess role then they should be redirected to /Home/Unauthorised/ I am curious how other people are handling

Why is onAuthorization executing before authentication?

阅读更多关于 Why is onAuthorization executing before authentication?

I'm trying to do some custom authorization so I created a controller overriding the OnAuthorization method. I also applied the Authorize attribute to this controller. The question is why is the OnAuthorization method called BEFORE the basic forms authentication process? I would like to authorize the user after he is authenticated. Am I missing something? Here is the code: [Authorize] public class AuthorizationController : Controller { protected override void OnAuthorization(AuthorizationContext filterContext) { base.OnAuthorization(filterContext); if (filterContext == null) { throw new

How do I prevent public downloads of files using php?

阅读更多关于 How do I prevent public downloads of files using php?

问题 I have a script that allows only authorised users to upload files to a certain folder. However I do not know how to prevent people from downloading freely without login. I need the solution in php. I have googled around but nothing straight forward as yet. Currently in my document root I have a folder called admin and a subfolder called uploads inside the admin. So only admin role can upload. Both editor and admin can download. What should I do in this case? Please advise. 回答1: Put the files