Recomendations for ACL?

Ktor Version

1.0.1

Ktor Engine Used(client or server and name)

Netty Server

JVM Version, Operating System and Relevant Context

JVM 1.8.0_181

Feedback

This isn’t a bug, more of a question/feature request. How do people handle access control.

For example, users only being able to access/edit their profile page, admins being able to access everywhere?

I started doing this in each get/post but felt like I was dumping access control responsibility on the controllers. So then I started adding intercepts for each route:

location<Route> {
 interceptUserIsLoggedIn()
}

My issue with that is now there feels like very loose coupling as I have my Access Control somewhere completely different.

Thoughts on best practices around this?

[otcdlink-simpleuser]

@chrisjenx I’ve taken inspiration from the following:

• Question: Modelling a Permissions System on Stack Overflow.
• RBAC (Role-Based Acces Control).
• Amazon IAM.
• Capability Myths Demolished , comparison of ACL and Capabilities.

[e5l]

Closed as answered