4 ms·
I tell everyone the same thing about access control. Don't check access. Also, never check file existence. These things just take up time, introduce race cond
by drewcoo 5y ago
I tell everyone the same thing about access control. Don't check access.
Also, never check file existence.
These things just take up time, introduce race conditions, and can't be trusted anyway.
That said, there are reasons to want to check some things with UI-level validation because calls to a slow back end are slow. Thus the name. I get that.
So if you're doing UI validation, don't get it right. Just get it mostly right. And do it fast. Cheat!
- mr_cyborg 5y ago> I tell everyone the same thing about access control. Don't check access. This caught my eye and I’m dying to know more - could you elaborate or point me to a good resource on this? My team has been dealing with some issues related to this recently.
- rascul 5y agoIt may be in reference to TOCTOU. [0] If you check that you can access a resource before you access that resource, you have implemented a race condition where you could potentially lose access to the resource in between the check and access attempt. It's probably not an issue if you have proper error handling, but it seems common to check that access is allowed then assume the resource will still be accessible later, without handling errors for when it's not. [0] https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use
- mr_cyborg 5y agoThank you so much for sharing this!