当前位置：文江博客话题详情

存储用户权限的最佳方式？

发布于 2024-09-18 12:12:19 字数 334 浏览 6 评论 0原文

设计一个相当复杂的网站，在单个页面上运行大量 ajax。我已经达到了一些用户需要具有特定权限才能执行操作而某些用户需要停止操作的地步。我已经在数据库中设置了用户角色，一切正常，但我想知道是否有一种更简单/更安全的方法来存储每个权限。

目前，当用户登录时，将从数据库中获取其特定权限并将其加载到会话数组中。要检查用户是否具有权限，我只需检查该权限是否包含在数组中。这看起来很缓慢，几乎就像我错过了更好的解决方案。

另外，会话显然可以由用户编辑......有没有更安全的方法？

我曾想过为每个检查运行一个查询，但这可能会大大增加简单 ajax 请求的加载时间。

我对任何想法都持开放态度。谢谢。

原文

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

浮萍、无处依 2024-09-25 12:12:20

首先也是最重要的，用户无法编辑会话变量。用户计算机上保存的唯一内容是会话 ID。然后，服务器使用该 ID 来获取仅存储在服务器上的键/值对。从客户的角度来看，不可能随心所欲地改变价值观。

其次，我不会太担心数据库连接。避免重复自己，但不要太担心第一次连接。

最后，我最喜欢的在不创建角色的情况下执行多个权限的方法是使用二进制数学。有些人喜欢这个，有些人不喜欢，但我发现它很有用。

要使用此方法，请想象我们定义以下值：

CAN_EDIT_SOMETHING        = 1     // Powers of 2
CAN_SEE_SOMETHING_ELSE    = 2
CAN_DO_ADMIN_STUFF        = 4
...                       = 8

要给予人们多个权限，请使用二进制 OR

PERMISSIONS = CAN_EDIT_SOMETHING | CAN_DO_ADMIN_STUFF

为了说明其工作原理，我们可以查看这些位：

   0b0001
OR 0b0100
---------
   0b0101

要检查某人是否拥有权限，请使用二进制 AND

if( PERMISSIONS & CAN_EDIT_SOMETHING != 0 ) {
}

要了解这是如何实现的有效，我们再次查看这些位。

    0b0101
AND 0b0001
----------
    0b0001  // Not equal to 0. They must have that permission!

此方法的最后一个好处是，它允许您轻松地将多个权限组合成“元权限”。

// If both EDIT_SOMETHING and ADMIN_STUFF are tasks that an admin
// can perform, we can combine them easily
//
IS_FULL_ADMIN     = CAN_EDIT_SOMETHING | CAN_DO_ADMIN_STUFF


// We can then use this value exactly as we do any other permission
//
PERMISSIONS       = IS_FULL_ADMIN | CAN_SEE_SOMETHING ELSE

如果您愿意，可以使用它，但它是您的武器库中的一个不错的技巧。

First and foremost, the user cannot edit Session variables. The only thing that is saved on the user's machine is a Session ID. That ID is then used by the server to grab key/value pairs that are stored ONLY on the server. From a client's standpoint, it is impossible to change values on a whim.

Second, I would not worry too heavily on a database connection. Avoid repeating yourself, but don't worry too much about the first connection.

Finally, my favorite way to do multiple permissions without creating roles is to use binary math. Some people like this, some people don't, but I find it useful.

To use this method, imaging that we define the following values:

CAN_EDIT_SOMETHING        = 1     // Powers of 2
CAN_SEE_SOMETHING_ELSE    = 2
CAN_DO_ADMIN_STUFF        = 4
...                       = 8

To give people multiple permissions, use binary OR

PERMISSIONS = CAN_EDIT_SOMETHING | CAN_DO_ADMIN_STUFF

To illustrate how this works, we can look at the bits:

   0b0001
OR 0b0100
---------
   0b0101

To check if someone has a permission, use binary AND

if( PERMISSIONS & CAN_EDIT_SOMETHING != 0 ) {
}

To see how this works, we look at the bits again

    0b0101
AND 0b0001
----------
    0b0001  // Not equal to 0. They must have that permission!

The final benefit of this method is that it allows you to combine multiple permissions easily into "meta-permissions"

// If both EDIT_SOMETHING and ADMIN_STUFF are tasks that an admin
// can perform, we can combine them easily
//
IS_FULL_ADMIN     = CAN_EDIT_SOMETHING | CAN_DO_ADMIN_STUFF


// We can then use this value exactly as we do any other permission
//
PERMISSIONS       = IS_FULL_ADMIN | CAN_SEE_SOMETHING ELSE

Use it if you want, but it is a nice trick to have in your arsenal.

回复收藏 0 原文