About web security (1)

We usually implement web security with Roles and Permissions.

a Database Table for users and one for Roles which users belongs and one for Permission for the roles which the users a role should have.


[Users Table]    <- Many-to-one -> [Roles Table] <-  One-to-many -> [Permissions Table]

The above model is the basic, but we can add extra relation between the Users and the Permissions to allow direct permission on the table regarding the role in which the user belongs.


The Authentication does from the Users table.. the user is there and not disabled.

The Authorization is all about answering the question of "Is the user has access to this restricted object?"

How Authorization done?

In Web - where the restricted object is all about URL resources - the autorization is done as follows:

• Every resource (a pattern for resources) in the system (should) have a list of permissions associated (usually only one) with it.
  Usually defined in the Permissions table as URL -> PERMISSION mapping. (or in XML as of spring-security)
  ex: '/editMyProfile.html' url mapped to CAN_EDIT_PROFILE permission.
  
• When the user successfully login, a list of all permission is attached to him (either role permissions or user permission as discussed before)
  
• Then when the user requests some URL, The system checks if the user has some attached permission that in the list of permissions that is associated with the url. If yes then the system allows the user to access the page, otherwise HTTP 403 is returned to the user.

How to draw the menu:

First you have your structure of menu (tree menu, list menu or whatever).

Initially, get all urls from Permissions table of the database and draw this permissions as following:

for (Permission p: permissions){

     if (userHavePermission(p.getPermissionName()){

           out.println(p.getUrl());

     }

}

the above is very simple code example.

Also you can consider nesting the menus by having a self-referential relationship in the Permissions table.