This was lazy for this year, and I was lazy, and I mentioned my BLOG today.
After the first two weeks of the year, I will not go well, but I have passed it soon. If things are smooth, the key is to see how they look, just like myself to comfort EIDDE, "What is big?" Hehe
Work, mainly research and use AUTHORIZATION, .NET SINK, AOP moral technologies.
There are several experiences (1) Authorization and authentication (Authenticion) is two-code child .... (2) a system authorization, the characteristics of their respective needs, the model can be perfect of. An authorized model, what do you want to think about, you have no way to use this model. (3) In our UI BizLogic distribution system, the client authorized verification is also authorized to authorize the server side, and it is also something that needs to be weighed. Just like Montaque, you can do not need to consider what the UI is implemented, expand your convenient point without considering the authorization. But why do you want our customers to have a button, logically go to the server to run, told customers that you have no authority? Especially like our UI operation-intensive system, I think or the user experience is more important, so I finally decided to implement permission verification in the client. (4) Host Bizlogic DB Access, permission, and business logic need to be clearly separated, it is best to be dependent on the interface layer or control layer has the dependence of authorization logic, in the business logic layer, must not be generated The dependence of permissions (for example, two different local customers enjoy different shopping discounts, please do not divide these two customers into different ROLE, use the customer's own Location flag to determine the judgment).
Using .NET Sink, it sounds beauty, the problem is also available (1) Is it in Remoting in Remoting, or hooks SINK to RemotingObject's ContextAtingObject (2) The efficiency is reduced, the logic dispersion, flexibility caused by formulation Loss....
