控制器和操作上的多个授权角色或用户的多个角色？
我正在尝试提出有关如何为我的控制器和操作设置角色的最佳实践。
我们在办公室进行辩论。我们是否应该为用户提供一个角色，并用一个或多个角色来装饰我们的控制器和操作，或者反之亦然，为一个用户提供多个角色，并用所需的最小访问角色来装饰控制器/操作？
I am trying to come up with the best practice on how to set up roles for my controllers and actions.
We have a debate in our office. Should we give one role to the user and decorate our controllers and actions with a list or roles, or viceversa, multiples roles to an user and have controllers/actions decorated with the minumum access role required?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
根据我的经验，最好允许用户承担多个角色。这是最灵活的方法，它将避免系统中角色数量的激增，因为不同的人通常在组织内担任不同的职务。这也简化了您的控制器/操作，因为您最多只需要一个角色。
In my experience, it has been better to allow a user to assume multiple roles. This is the most flexible approach, and it will avoid an explosion in the number of roles in the system, because different people often wear different hats within an organization. This also simplifies your controllers/actions because you only need at most one role per.
我认为这完全取决于您希望用户做什么。担任管理员角色的人是否只能执行管理员类型的操作或所有操作？
我们遇到了类似的问题，我们决定采用 4 个不同的角色，并根据用户需要访问的内容为他们分配多个角色。
I think this depends entirely on what you want your users to be doing. Is a person in an admin role only going to be able to do admin type things or everything?
We had a similar issue come up and we decided to go with 4 different roles and assigned multiple roles to users based on what they needed access to.