如何在Play Framework中编写“用户只能访问自己的个人资料页面”类型的安全性检查？

Question

I have a Play framework application that has a model like this: A Company has one and only one User associated with it.

I have URLs like http://www.example.com/companies/1234 , http://www.example.com/companies/1234/departments , http://www.example.com/companies/1234/departments/employees and so on. The numbers are the company id's, not the user id's.

I want that normal users (not admins) should only be able to access their own profile pages, not other people's profile pages. So a user associated with the company with id 1234 should not be able to access the URL http://www.example.com/companies/6789

I tried to accomplish this by overriding Secure.check() and comparing the request parameter "id" to the ID of the company associated with the logged in user. However, this obviously fails if the parameter is called anything else than "id".

Does anyone know how this could be accomplished?

Answer 1

You could have a simple @Before function, or if it is only on the view page that you want to apply the security, then you could have a simple bit of code at the beginning that checks the user's id (I assume from the session), and checks that they are allowed to access the page, by getting the User form the id in the session, and the Company from the id passed in, and checking against each other.

If security fails, then either return a badrequest instead of render, or call an action that shows a notAuthorised custom page.

Answer 2

You could make a SecureProfileController class that extends Controller, has a method that does the checkCompanyId-that-is-to-be-viewed against users companyId, and let the controllers that need that logic extend the SecureController.

If the method is an @Before function, like Codemwnci says, then it can intercept all the action methods in the inherited classes.

Alternatively you could have a look at Deadbolt, where you can setup roles for users and restrict access based on those roles: http://www.playframework.org/modules/deadbolt-1.0/home

Hope that helps :)