采用 Coldfusion 的安全层次结构编码风格
我创建这个相当大的网络应用程序已经有一段时间了，并且一直在更新它。随着时间的推移，我学到了很多东西，使系统更加实用。现在，我要回去尝试删除不可重用或只是简单奇怪/古怪的代码。
我的第一步是查看我的安全层次结构。我的系统在安全级别主干上运行。 X级别可以查看X内容...等等。
编码的最佳方法是什么？现在，我有一个查询可以检索其安全级别并将其设置为会话变量。这些人还可以属于许多其他具有不同安全级别的“部门”。 （该部门也存储为会话变量。）我系统中的网页会检查我的标头以查看它们是否可以访问该页面。但是，在某些地方，我拥有只有特定安全级别才能查看的动态表单和数据。在这些领域，我几乎有 cfif 声明，说明如果安全性等于某个级别...向他们展示这个或向他们展示那个。因此，在同一页面上，有人可能会看到不同的东西。
有更好的方法来处理这个问题吗？我觉得我的代码没有达到应有的水平。 （嗯，它永远不会像它可能的那样好。）我基本上是在寻找有关如何以更好的方式处理安全层次结构的建议。
（注意：我已经对系统进行了编码，只是寻求有关编码风格的建议或验证我正在做的事情听起来是否正确！”）
我还在努力让我的查询更像......并且全部集中在一个地方，所以它们不会在某些页面上随机浮动。
I've been creating this pretty large web application for sometime and have been updating it. Overtime, I've learned a lot more things to make the system more functional. Now, I'm going back and trying to get rid of code that isn't re-useable or is just plain odd/ quirky.
My first step is looking at my security hierarchy. My system runs on a security level backbone. X level can view X stuff...etc.
What is the best way to code that? Right now, I have a query that retrieves their security level and sets it as a session variable. These people can also belong to many other "departments" with different security levels. (The department is also stored as a session variable.) The webpages in my system check in my header to see if they can access the page or not. However, there is some places where I have dynamic forms and data that only certain security levels can view. In these areas I pretty much have cfif statements saying if security equals a certain level...show them this or show them that. So, on the same page someone might see something different.
Is there a better way to handle this? I feel like my code isn't as good as it could be. (Well, it will never be as good as it could be.) I'm basically looking for suggestions on how to handle a security hierarchy in a better way.
(Note: I already have the system coded just looking for advise on coding style or verification if what I'm doing sounds right!")
I'm also working on getting my queries more function like...and all in one place so they are not floating around randomly on some pages.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
ColdFusion 内置了基于角色的安全性。您可以使用
roles属性和IsUserInRole()函数进行授权检查。此外，您还有一个
roles属性CFC 功能。它们采用逗号分隔的角色列表，用户必须属于该角色才能执行该功能。您的工作是管理角色成员资格（通过数据库表）并在会话开始时建立用户上下文。
如果您将业务逻辑抽象为组件，并考虑创建合理的角色，则可以在应用程序上强加一个非常易于使用的安全模型。
ColdFusion has role-based security built in. You have
<cfloginuser>with itsrolesattribute and theIsUserInRole()function for authorization checks.Also, you have a
rolesattribute on CFC functions. These take a comma-separated list of roles the user must be part of to be allowed to execute the function.Your job would be to manage role membership (though a database table) and establish a user context when a session begins.
If you abstract your business logic away into components and put some thought into creating sensible roles, you can impose a very simple-to-use security model on your application.