Re: [aerogear-dev] AeroGear Controller, Security…(SoC), oh my
On 02/20/2013 08:25 AM, Bruno Oliveira wrote:
Good morning slackers.
Today I was chatting with Dan about some cross-cutting concerns like
CORS, XSS mitigation, HSTS, CSP. They have something related with
security, but is not because it has "security" into the specification,
that it MUST be inside AG-sec.
They're cross-cutting concerns and I'd like to have it in a single
place to be used as dependency. So what are the alternatives?
I like all of these options, and I will reply with my thoughts inline.
1- Put it inside AG-Controller and AG sec will be just the bridge to
providers like PicketLink
I enjoy monolithic libraries/applications because it is
fewer jars to
download/manage. This also helps keep down some of the paradox of
choice problems that happen in say Spring where exactly which library I
want is a crapshoot so I just get them all. Fortunately with
Maven/Ivy/Gradle tooling my IDE can search for the pack which contains
the classes/functionality I am referencing so that concern is mitigated
somewhat.
2- Put it inside AG-Sec and decoupled from AG-Controller, if you want
to add security on AG-Controller based apps, you just include AG-Sec
as dependency
This give AG-security something which lets it tell a different story
from Spring security (which I think is only Auth/Authz). It keeps the
controller "kernel" lighter and makes it easier for someone to
understand what AG-Controller is doing under the hood.
3- And Matthias suggested the creation of ag-controller plugins.
Keeping everything really bite sized makes it very nice for
hackers/tinkerers to understand how we are implementing a security
feature. This gives the community a lower barrier to entry (perhaps).
It has some of the problems I mentioned in 1. (IE the crapshoot of
necessary jars) but has benefits too (smaller downloads, easier to get
up and running etc)
So…...what do you think?
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Summers
Volenti Nihil Difficile
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Volenti Nihil Difficile
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
Attachments:
- attachment.html (text/html — 4.7 KB)