Skip to main content

Weak software design - Restrict user access in the web applications

Today I want to talk about a smell that I way sometimes on web application. We will start with a short story to create a context for our smell.
One day a request comes to the developer that he needs to create a page where the user can view a list of items. For each item the user can view details, edit an item and delete it. After a while the manager changes the request: “Only specific users can edit or delete items from the list”. Our developer based on the role of a user identifies what user can edit or delete items and for the rest of the user he decides to hide the two buttons.
When we look over the code something is wrong. If the user knows the URL for the edit page of an item or for deletion, he can edit and delete any items even if is not an admin.
We should never trust inputs that come from users. Every time we should validate on the server side the data from the user and also if he has rights to do execute a command or view a specific page.
In MVC application is very simple to do this. We only need to add an attribute to specific actions that we want to be access based on the user role. Another simple solution is to check if the user is part of a given role using the following method “Page.User.IsInRole(“RoleName”)”.
Be aware when you limit access of a user. For each access to a restricted area you should check the user rights. Don’t trust anything that the user sends to you.


  1. This is not a code smell, it's just plain weak software design.. :)
    Authorization for any real-world application should be designed upfront, not as an after-though, event if it's hard to get right.

    1. This was not the first time when i saw this problem.
      I look over the internet and in some places is marked as code smell. I will update the title, thank you.


Post a Comment

Popular posts from this blog

ADO.NET provider with invariant name 'System.Data.SqlClient' could not be loaded

Today blog post will be started with the following error when running DB tests on the CI machine:
threw exception: System.InvalidOperationException: The Entity Framework provider type 'System.Data.Entity.SqlServer.SqlProviderServices, EntityFramework.SqlServer' registered in the application config file for the ADO.NET provider with invariant name 'System.Data.SqlClient' could not be loaded. Make sure that the assembly-qualified name is used and that the assembly is available to the running application. See for more information. at System.Data.Entity.Infrastructure.DependencyResolution.ProviderServicesFactory.GetInstance(String providerTypeName, String providerInvariantName) This error happened only on the Continuous Integration machine. On the devs machines, everything has fine. The classic problem – on my machine it’s working. The CI has the following configuration:

TeamCity.NET 4.51EF 6.0.2VS2013
It seems that there …

How to check in AngularJS if a service was register or not

There are cases when you need to check in a service or a controller was register in AngularJS.
For example a valid use case is when you have the same implementation running on multiple application. In this case, you may want to intercept the HTTP provider and add a custom step there. This step don’t needs to run on all the application, only in the one where the service exist and register.
A solution for this case would be to have a flag in the configuration that specify this. In the core you would have an IF that would check the value of this flag.
Another solution is to check if a specific service was register in AngularJS or not. If the service was register that you would execute your own logic.
To check if a service was register or not in AngularJS container you need to call the ‘has’ method of ‘inhector’. It will return TRUE if the service was register.
if ($injector.has('httpInterceptorService')) { $httpProvider.interceptors.push('httpInterceptorService&#…

Fundamental Books of a Software Engineer (version 2018)

More then six years ago I wrote a blog post about fundamental books that any software engineer (developer) should read. Now it is an excellent time to update this list with new entries.

There are 5 different categories of books, that represent the recommended path. For example, you start with Coding books, after that, you read books about Programming, Design and so on.
There are some books about C++ that I recommend not because you shall know C++, only because the concepts that you can learn from it.


Writing solid codeCode completeProgramming Pearls, more programming pearls(recommended)[NEW] Introduction to Algorithms


Refactoring (M. Fowler)Pragmatic ProgrammerClean code[NEW] Software Engineering: A Practitioner's Approach[NEW] The Mythical Man-Month[NEW] The Art of Computer Programming


Applying UML and Patterns (GRASP patterns)C++ coding standards (Sutter, Alexandrescu)The C++ programming language (Stroustrup, Part IV)Object-oriented programming (Peter Coad)P…