[Springframework-developer] Re: Security Interceptor on display components

[Stephane B. <sba...@ap...>]

Andy Depue wrote:

> This is something I too am interested in.... though we will ultimately be 
> using Spring + JSF with the addition of some rich clients when the time 
> comes.  I will need a solution that can work for both the web and rich client 
> UIs.

I think that the AOP approach should work particulary well with JSF as 
everything is normally a component. There are a couple of issues to 
solve though (which are also valid for Struts html taglibs)

- it means that we must have an object filter that replaces for example 
the sensitive value returned via get methods with a "***". This makes 
sense in place where the information is visible on a shared page and 
where it would be difficult to actually modify the whole page layout. 
Otherwise if everything is separated in a different page it is solved 
very easily anyway.

- When the object is not editable, it means that basically we need to 
disable the component which value is the sensitive one. So we must have 
a filter on the visual component.

- The problem to solve is also when we update the object. If we just 
filtered the object by adding "***" and it is not editable..we of course 
need to avoid this object being updated with the "***" value. So we need 
to intercept here again.

The problem is also in the case when an 'action' wraps a hidden 
component. For example an hyperlink over a "***" value. This is a 
special case though that could be solve as well with an interceptor but 
that's starts to be tricky.

I can definitely see however how it would simplify development 
dramatically... that would be an extremely powerful application of AOP 
on something that is definitely cross cutting.

Stephane