7:25 a.m.
Good morning slackers.
Today I was chatting with Dan about some cross-cutting concerns like CORS, XSS mitigation,
HSTS, CSP. They have something related with security, but is not because it has
"security" into the specification, that it MUST be inside AG-sec.
They're cross-cutting concerns and I'd like to have it in a single place to be
used as dependency. So what are the alternatives?
1- Put it inside AG-Controller and AG sec will be just the bridge to providers like
PicketLink
2- Put it inside AG-Sec and decoupled from AG-Controller, if you want to add security on
AG-Controller based apps, you just include AG-Sec as dependency
3- And Matthias suggested the creation of ag-controller plugins.
So…...what do you think?
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Volenti Nihil Difficile
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Volenti Nihil Difficile
8:55 a.m.
On 02/20/2013 08:25 AM, Bruno Oliveira wrote:
Good morning slackers.
Today I was chatting with Dan about some cross-cutting concerns like
CORS, XSS mitigation, HSTS, CSP. They have something related with
security, but is not because it has "security" into the specification,
that it MUST be inside AG-sec.
They're cross-cutting concerns and I'd like to have it in a single
place to be used as dependency. So what are the alternatives?
I like all of these options, and I will reply with my thoughts inline.
1- Put it inside AG-Controller and AG sec will be just the bridge to
providers like PicketLink
I enjoy monolithic libraries/applications because it is
fewer jars to
download/manage. This also helps keep down some of the paradox of
choice problems that happen in say Spring where exactly which library I
want is a crapshoot so I just get them all. Fortunately with
Maven/Ivy/Gradle tooling my IDE can search for the pack which contains
the classes/functionality I am referencing so that concern is mitigated
somewhat.
2- Put it inside AG-Sec and decoupled from AG-Controller, if you want
to add security on AG-Controller based apps, you just include AG-Sec
as dependency
This give AG-security something which lets it tell a different story
from Spring security (which I think is only Auth/Authz). It keeps the
controller "kernel" lighter and makes it easier for someone to
understand what AG-Controller is doing under the hood.
3- And Matthias suggested the creation of ag-controller plugins.
Keeping everything really bite sized makes it very nice for
hackers/tinkerers to understand how we are implementing a security
feature. This gives the community a lower barrier to entry (perhaps).
It has some of the problems I mentioned in 1. (IE the crapshoot of
necessary jars) but has benefits too (smaller downloads, easier to get
up and running etc)
So…...what do you think?
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Summers
Volenti Nihil Difficile
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Volenti Nihil Difficile
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
9:14 a.m.
I vote for two or three - summers comments are spot on :)
-- qmx (mobile)
On 20/02/2013, at 10:25, Bruno Oliveira <bruno(a)abstractj.org> wrote:
Good morning slackers.
Today I was chatting with Dan about some cross-cutting concerns like CORS, XSS
mitigation, HSTS, CSP. They have something related with security, but is not because it
has "security" into the specification, that it MUST be inside AG-sec.
They're cross-cutting concerns and I'd like to have it in a single place to be
used as dependency. So what are the alternatives?
1- Put it inside AG-Controller and AG sec will be just the bridge to providers like
PicketLink
2- Put it inside AG-Sec and decoupled from AG-Controller, if you want to add security on
AG-Controller based apps, you just include AG-Sec as dependency
3- And Matthias suggested the creation of ag-controller plugins.
So…...what do you think?
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Volenti Nihil Difficile
--
"The measure of a man is what he does with power" - Plato
-
@abstractj
-
Volenti Nihil Difficile
_______________________________________________
aerogear-dev mailing list
aerogear-dev(a)lists.jboss.org
https://lists.jboss.org/mailman/listinfo/aerogear-dev
4323
days inactive
4324
days old
2 comments
3 participants
participants (3)
-
Bruno Oliveira -
Douglas Campos -
Summers Pittman