在 Web 软件中构建安全架构（创建 API）
我在数据库中有一组操作，例如添加用户、编辑用户、导入用户、发送邀请等。我已将这些权限附加到角色。然后我将这些角色附加给用户。
我可以创建一个好的模式或 API 来使用它吗？我不想在代码中放置一堆 if/else 语句来检查权限。那么接口也许会很好？抱歉这么含糊，我只是不知道从哪里开始并寻找有关如何开始的建议（也许是授权规则提供者？）。预先感谢您的任何帮助。
I have a set of actions in a database, such as Add User, Edit User, Import Users, Send Invitation, etc. I have attached these permissions to roles. Then I attached these roles to users.
Is there a good pattern or API I can create for using this? I do not want to put a bunch of if/else statements in the code to check for permissions. So maybe interfaces would be good? Sorry for being so vague, I just do not know where to start and looking for advise on how to start this (perhaps an authorization rule provider?). Thanks in advance for any help.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
微软的角色和成员资格太基础了，感觉它只处理身份验证而不处理授权。
但我找到了我正在寻找的东西......Rhino Security！
http://www.ryantomlinson.com/post /An-Enterprise-Authorization-Framework-Part-1-Introduction.aspx
Microsoft's Roles and membership is too basic and felt like it only deals with authentication but no authorization.
BUT I found exactly what I was looking for... Rhino Security!
http://www.ryantomlinson.com/post/An-Enterprise-Authorization-Framework-Part-1-Introduction.aspx
角色和成员资格可能值得一看 - http://msdn.microsoft.com/ en-us/library/yh26yfzy.aspx
这对于您的网站来说可能有些过大，但它很容易使用和实现。
Roles and membership might be worth looking at - http://msdn.microsoft.com/en-us/library/yh26yfzy.aspx
It might be overkill for your site, but it is easy to use and implement.