Rbac permission authentication. Is the user permission stored in the session? -SegmentFault

Rbac permission authentication: a user cannot query the database once every request after logging on. 1. Do you want to retrieve all the interface addresses with permissions and save them to the session? 2. In laravel, some interfaces need to be authenticated, some interfaces are open, and I am using routes like this. Is there any...

Rbac permission authentication.
After a user logs on, it is impossible to query the database once every request.
1. Is it possible to retrieve all the interface addresses with permissions and save them to the session?
2. In laravel, some interfaces need to be authenticated, some interfaces are open, and I am using this route. Is there a more elegant way to implement it?

Route::group(['prefix' => 'api/v1'],function(){    Route::post('login',"AccountController@Login");    Route::group(['middleware'=>'auth'],function(){        Route::get("paper","PaperController@Index");    });});

3. node tables in rbac are stored in this way.

A large node has a specific interface address. Is this suitable? Do you save it like this?
Table data must be updated for each newly added interface. Is there any more elegant implementation method.

Reply content:

Rbac permission authentication.
After a user logs on, it is impossible to query the database once every request.
1. Is it possible to retrieve all the interface addresses with permissions and save them to the session?
2. In laravel, some interfaces need to be authenticated, some interfaces are open, and I am using this route. Is there a more elegant way to implement it?

Route::group(['prefix' => 'api/v1'],function(){    Route::post('login',"AccountController@Login");    Route::group(['middleware'=>'auth'],function(){        Route::get("paper","PaperController@Index");    });});

3. node tables in rbac are stored in this way.

A large node has a specific interface address. Is this suitable? Do you save it like this?
Table data must be updated for each newly added interface. Is there any more elegant implementation method.

• Ask a question five hours ago
• Comment
• Reply

Please log on first and then comment

Sort by default

One answer

The answer is helpful to people and has reference value.1The answer is not helpful. It is a wrong answer.

1-it is inevitable that the session exists. Therefore, after modifying the permission, the corresponding user needs to log on again.
2-I have not studied laravel's rbac carefully, but it looks pretty good to use middleware. Of course, you can also consider verifying it without routing, instead, it is verified when the final distribution is complete (for example, it is verified when the controller is constructed. Of course, this requires the path to be the controller/action structure rather than the route address)
3-The data structure can meet your needs, but you may not start with/or start. It is inevitable that data tables must be updated for each newly added interface. You only need to write a function to automatically synchronize data. Obviously there is a problem with your data. The id = 25 Data pid should not be 4.

In addition, another disadvantage of the design is that the top-level permissions are not defined, which makes management more troublesome. Generally, we define a top-level permission. Other permissions are its direct and indirect subnodes. In this way, the admin user is OK as long as he has the top-level permission and will not be affected by interface data updates.