Security (was: Re: Pier user in context)
Hans N Beck <HNBeck <at> t-online.de>
2006-05-01 09:31:04 GMT
Hi Lukas,
Am 30.04.2006 um 21:55 schrieb Lukas Renggli:
>> For security and web, I'm a little bit paranoid, especially at
>> such powerful systems like Pier
I've discussed security in
>> Seaside/Pier with a friend, and from this I'm not sure today what I
>> expect from such systems like seaside/pier. He says, security
>> belongs only to buisness logic. I'm not so shure, also what to call
>> buisness logic in Pier...... I will post a related question to the
>> list later.
>
> If your friend means "model" when talking about "business logic", he
> is right: the security decoration is a pure model object, that works
> exactly the same for all views, not just seaside one. Thanks to the
> nature of visitors one can easily control how security concerns are
> handled when performing operations.
Yes, I know that this is a common way to think. What bothers me is
this (from a naive point of view):
- security should not something which is only be added (thats the
nature of decoration), because what was added can also be removed or
forget to add. It seems more natural to me that security is deep in
the mechanism of objects (or better message send), like the vats in E
or Islands in Croquet.
- if one say model or buisness logic, one could easily think at the
multi tier architectures. Here it is a common way to say, security
must handled be the database objects (for example), not by the
(Continue reading)