Uploaded image for project: 'Seam 2'
  1. Seam 2
  2. JBSEAM-1224

Consider integration of security with App Framework

    Details

    • Type: Feature Request
    • Status: Open (View Workflow)
    • Priority: Major
    • Resolution: Unresolved
    • Affects Version/s: 1.2.1.GA
    • Fix Version/s: None
    • Component/s: Core, Security
    • Labels:
      None

      Description

      From the forums:

      'One down side to using EntityHome for generic crud is lack of built in security. One needs to be careful when using Homes for crud operations that allow or require RequestParameters. You need to ensure the operation on this ID is valid. You don't want to expose information you shouldn't and you definitely don't want to modify or destroy information you shouldn't.

      For example, you don't want a user to update or delete another user's entity just by changing an ID in the URL and hitting return. Seam supports entity level security and you can probably extend a Home to double check access restrictions prior to operations. Likewise, you don't want private information available on lets say a user profile screen, to be available to anyone able to modify a URL.'

        Gliffy Diagrams

          Attachments

            Issue Links

              Activity

                People

                • Assignee:
                  shane.bryzak Shane Bryzak
                  Reporter:
                  pmuir Pete Muir
                • Votes:
                  4 Vote for this issue
                  Watchers:
                  4 Start watching this issue

                  Dates

                  • Created:
                    Updated: