Comments (2)
Hiding $select
in before
hooks and restoring it in after
hooks makes it so the authorize
hook needs to be placed last in before hooks and first in after hooks. One obvious downside to this is that you can't simply add the authorize
hook as an app level before all hook.
When migrating my app to feathers-casl
, this caused an issue. My current CASL implementation tries to authenticate and authorize every external request in a before all hook. However, needing to move my authorize
hook to right before each method call means that all my validation hooks are running before authorization. This means that users that shouldn't have access to a resource would be getting validation errors instead of authorization errors. I think authorization should be one of the first things checked and should be able to fail fast. If a user doesn't have access to a resource, they should always get a Forbidden
error.
This is another example/use case where not needing to hide/restore $select
would be advantageous.
I spoke with @fratzinger about this outside of GitHub, and he mentioned another potential solution to the issue I'm experiencing: adding a lightweight version of the authorize
hook that doesn't need to hide/restore $select
, could be used in any hook, but would not work for field level validations (since the reason for the $select
stuff is to handle field level validations). This might deserve to be its own issue, but @fratzinger, would this solution you're talking about here potentially fix my issue too?
from feathers-casl.
released as preversion v0.5.1-0
(#28)
from feathers-casl.
Related Issues (20)
- fix: check if `_get` is existent, and if not, use `get` with `skipHooks` HOT 1
- Channels: function with initial Channel | Channel[] | Connection[] for calculations before feathers-casl
- new util to update connections
- new flag for hook: `useOptionsOverParamsAbility`
- Next version for feathers 5 HOT 3
- Nest JS authorization with CASL doesn't work as expected HOT 1
- You're not allowed to get on 'users' HOT 3
- AbilityBuilder expected 1 arguement, but got 0 HOT 3
- Is the anonymous channel needed anymore? HOT 7
- Remove ability on logout
- remove: No record found for id HOT 5
- Missing resource results in "You are not allowed to get X" message HOT 3
- [Question] Custom adapter HOT 1
- How can we express an ltree condition with feathers-casl? HOT 1
- [email protected] - error with 'feathers-utils' is a CommonJS module HOT 2
- Support for casl v6 ? HOT 2
- Documentation contains non-existent reference to @casl/ability -> makeAbilityFromRules HOT 3
- Documentation section 'add-abilities-to-hooks-context': wrong import file reference
- Ability to have multiple "stages" for permissions?
- find rule with restricted field not working HOT 2
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from feathers-casl.