管理 Web 应用程序权限的最佳方法是什么 - 位掩码或数据库表?

问题描述

我正在考虑为管理员"Web 应用程序设计权限系统的最佳方式.应用程序可能有很多用户，每个用户都可以被分配一个特定的角色；其中一些用户可能被允许执行角色之外的特定任务.

我可以想到两种设计方法:一种是权限"表，每个用户都有一行，每个任务一个布尔列，为他们分配执行这些任务的权限.像这样:

用户 ID 管理用户 管理产品 管理促销 管理订单1 true true true true2 假真真真真3 假假假真

我想到的另一种方法是使用位掩码来存储这些用户权限.对于 32 位有符号整数，这会将可以管理的任务数量限制为 31 个，但实际上我们不太可能拥有超过 31 个用户可以执行的特定任务.这样，数据库模式会更简单，而且每次添加需要访问控制的新任务时，我们都不必更改表结构.像这样:

用户 ID 权限(8 位掩码)，将是表中的整数1 000011112 000001113 00000001

这里的人们通常使用什么机制，为什么?

谢谢！

解决方案

我认为远离编码宇宙意义的神秘比特串是一个普遍的经验法则.

虽然可能比较笨拙，但拥有一个可能的权限表、一个用户表以及它们之间的链接表是最好和最清晰的组织方式.它还使您的查询和维护(尤其是对于新人)更容易.

I'm considering the best way to design a permissions system for an "admin" web application. The application is likely to have many users, each of whom could be assigned a certain role; some of these users could be permitted to perform specific tasks outside the role.

I can think of two ways to design this: one, with a "permissions" table with a row for every user, and boolean columns, one for each task, that assign them permissions to perform those tasks. Like this:

User ID          Manage Users     Manage Products     Manage Promotions     Manage Orders
1                true             true                true                  true
2                false            true                true                  true
3                false            false               false                 true

Another way I thought of was to use a bit mask to store these user permissions. This would limit the number of tasks that could be managed to 31 for a 32-bit signed integer, but in practice we're unlikely to have more than 31 specific tasks that a user could perform. This way, the database schema would be simpler, and we wouldn't have to change the table structure every time we added a new task that would need access control. Like this:

User ID          Permissions (8-bit mask), would be ints in table
1                00001111
2                00000111
3                00000001

What mechanisms have people here typically used, and why?

Thanks!

解决方案

I think it's a general rule of thumb to stay away from mystical bitstrings that encode the meaning of the universe.

While perhaps clunkier, having a table of possible permissions, a table of users, and a link table between them is the best and clearest way to organize this. It also makes your queries and maintenance (especially for the new guy) a lot easier.

这篇关于管理 Web 应用程序权限的最佳方法是什么 - 位掩码或数据库表?的文章就介绍到这了，希望我们推荐的答案对大家有所帮助，也希望大家多多支持！