Spring Security - is Role and ACL security overkill?
Posted
by HDave
on Stack Overflow
See other posts from Stack Overflow
or by HDave
Published on 2010-06-01T02:03:42Z
Indexed on
2010/06/01
2:13 UTC
Read the original article
Hit count: 586
I have a 3 tier application that requires security authorizations be placed on various domain objects.
Whether I use Spring's ACL implementation or roll my own, it seems to me that ACL based security can only be used to authorize (service) methods and cannot be used to authorize URL or web service invocations. I think this because how could a web service call check the ACL before it has hydrated the XML payload? Also, all the examples for web access security in the Spring documentation are securing URL's based on Role.
Is it typical to use Spring's roles to secure web presentation and web service calls, while at the same time using ACL's to secure the business methods? Is this overkill?
© Stack Overflow or respective owner
