This post originated from an RSS feed registered with Agile Buzz by Martin Fowler. Original Post: Basics of Web Application Security: Authorize Actions Feed Title: Martin Fowler's Bliki Feed URL: http://martinfowler.com/feed.atom Feed Description: A cross between a blog and wiki of my partly-formed ideas on software development Latest Agile Buzz Posts Latest Agile Buzz Posts by Martin Fowler Latest Posts From Martin Fowler's Bliki

Authentication means you know who your user is, protecting their session ensures that information stays correct. Now Cade and Daniel move on to authorization: checking that users only do what they are allowed to do. Authorization should always be checked on the server and should deny by default. Actual authorization schemes are domain-specific, but some common patterns help get you started.

more…