Lesson 06 · 11 min
Roles and permissions
Signing in is half of it. The other half is what exactly you're allowed to do.
The simplest model is roles (RBAC): each role has a set of permissions, and each user has a role. The code doesn't ask "is this an admin?" but "may this user do orders:refund?". The owner is checked separately: an editor may change articles, but only their own. Both checks happen on the server, on every request.
Sign in to continue
The rest of this lesson opens after sign up
The first lesson of every course is open without an account. To read on, solve the practice and use Ask, create a free account or log in.