When a users tries to perform a function they are not authorised to perform the are redirected to the unauthorised page.
What would be more helpful would be to report which permissions would be needed to perform the function that they were trying to perform.
Permissions are littered throughout the application layer so this raises some questions about how permissions are tied to pieces of functionality and the best way to report on this.
For example, a users may need two permissions to perform a specific function, but we may only have reached the check for the first when the authorisation issue is identified. At that point we'll not look at any further code. Perhaps that's ok?
This is an extraction of a requirement from item #15
When a users tries to perform a function they are not authorised to perform the are redirected to the unauthorised page.
What would be more helpful would be to report which permissions would be needed to perform the function that they were trying to perform.
Permissions are littered throughout the application layer so this raises some questions about how permissions are tied to pieces of functionality and the best way to report on this.
For example, a users may need two permissions to perform a specific function, but we may only have reached the check for the first when the authorisation issue is identified. At that point we'll not look at any further code. Perhaps that's ok?
This is an extraction of a requirement from item #15