Field Level Security (in rails) "Done Right"

Sat, 09 Nov 2024 00:45:24 -0600

I’m a huge proponent of believing that security shouldn’t be something that’s baked in after the fact – it’s something that should be all or nothing from day one. I realize that this is probably a wild and opinionated point of view, but, let me try to explain:

When your application starts out, user account security is usually one of the things that you think of last unless you’re utilizing a framework that has some type of tenant segregation in from day one. While security is usually brought into the product at some point after the core functionality of the MVP is introduced, this is the point in the development lifecycle that can really make or break your application: make the right choice: a library that is well maintained, well documented, and well-tested, and hope that it not only has the support of the community, but, pray that it doesn’t commercialize itself later down the road breaking your core functionality…or, roll your own. Rolling your own means ensuring that you’ve got a well-built set of definitions and goals for your authorization stack and that you’ve thought of everything your application needs from day one. Realizing that it’s a step in futility, most good engineers will try to add some things to your application to allow it to ‘future-proof’ the application, basically locking himself to be the ‘forever authz guy’ or worse, detrimental to your engineering team when that engineer leaves and all of that domain knowledge of the library or gem leaves after everyone on his team has left. (Oddly specific because I’ve lived through it. Twice). How do you solve for that? In my mind, that’s getting as close to the data as you can, and building forward from there. That’s where Soter comes in. Soter’s opinionated, secure by default, and easy to implement. Soter works on the belief that all data should be graded from the moment where it’s defined in the Model – if the model hasn’t been graded, then the data is unavailable to display to the user. Grading the data is mandatory, but, granting access is optional. You could have fields that could only be available to the application, prohibited by rules in being returned as a JSON or other object, keeping those fields secure by default.

Field-Level on Ian's (not so) technical blog

Field Level Security (in rails) "Done Right"