Re: Security Checks in API functions

On 21 apr 2009, at 12:44, [email protected] wrote:

> API functions are always called by something else, so the idea  
> presents
> itself: why not relegate security checking to whatever calls the API
> function in the first place?

I'd actually argue the reverse situation, i.e. put the security check  
in the common place. The API functions are the 'action' handlers,  
which imo should contain security checks, so whoever/whatever calls  
them does not have to be bothered by them (if they dont want to or  
cant), but it is also ensured that the action is properly filtered/ 
protected at all times.

Is the real problem not in the security checks themselves? If i recall  
correctly they could benefit hugely by caching implemented in the  
proper places, or was that already implemented?

marcel

-- 
Marcel van der Boom  -- http://hsdev.com/mvdb.vcf
HS-Development BV    -- http://www.hsdev.com
So! web applications -- http://make-it-so.info
Cobra Replica build  -- http://cobra.mrblog.nl

_______________________________________________
Xaraya_devel mailing list
[email protected]
http://xaraya.com/mailman/listinfo/xaraya_devel