tag:blogger.com,1999:blog-5950537015062599287.post7735539191162975114..comments2012-01-28T18:51:14.342+11:00Richardhttp://www.blogger.com/profile/11191015489042575122noreply@blogger.comBlogger2125tag:blogger.com,1999:blog-5950537015062599287.post-38369147585289085452012-01-28T18:51:14.342+11:002012-01-28T18:51:14.342+11:00Anton,<br /><br />Thanks for your comments.<br /><br />First let me emphasise: the above is just what has worked for us, in my opinion. So I&#39;m not saying &quot;db sequences with increasing ids are not good&quot; as a general rule.<br /><br />However let&#39;s say you need &#39;fine-grained&#39; security. Not just Role Customer can access &#39;/order&#39; and cannot access &#39;/admin&#39;. But more subtle rules like &#39;Customer ABC can see their order number 123, and so can Account Manager XYZ, but Customer DEF mustn&#39;t&#39;. It&#39;s very easy to get such rules wrong: to miss some permutation and accidentally allow the wrong role to access the wrong data.<br /><br />The main way they will &#39;access the wrong data&#39; is by using the ID of the wrong data. Customer DEF might, for example, try to hit a URL &#39;/order?id=123&#39;. So a great first line of defense is to protect those IDs. We do this in two ways.<br /><br />First, we make them unguessable because they are not just incrementing. Second, we encrypt them to the logged-in user&#39;s password. That way, even if someone is &#39;looking over your shoulder&#39;, the IDs they see on the URL will not work for them.Richardhttp://www.blogger.com/profile/11191015489042575122noreply@blogger.comtag:blogger.com,1999:blog-5950537015062599287.post-65107595313898085882012-01-28T02:20:43.572+11:002012-01-28T02:20:43.572+11:00Perfect post! Empty JSF/CDI bean classes are frustrating and boilerplate so the generic EL resolver is a really good idea, also search object is great! Could not understand the UUID idea - why the db sequences with increasing ids is not good? If the user does not have the access to the entity 124 but has for 123 - system must check this and redirect to error page or show illegal access message. Also could not understand the need to generate names of fields - this may make the developing and debuging process much more difficult though security reasons are not clear..<br />Thanks.Antonhttp://www.blogger.com/profile/10896648740096795357noreply@blogger.com