https://wiki.owasp.org/api.php?action=feedcontributions&feedformat=atom&user=Monzillo 2026-05-15T15:16:05Z User contributions MediaWiki 1.27.2 https://wiki.owasp.org/index.php?title=ESAPI_Access_Control&diff=48392 2008-12-11T15:03:41Z

<p>Monzillo: </p> <hr /> <div>== Feature Overview ==<br /> <br /> TODO<br /> <br /> == Possible Enhancements == <br /> <br /> Currently the access controller simply allows for lookup on an access control matrix. Enhancements will allow for special function(s) to be created for more complex access control rules (for example, a user has access to a file but only Monday - Friday, not on weekends).<br /> <br /> So the simple case (lookup in an access control matrix:<br /> * isValid(user, action_string)<br /> <br /> Custom Case<br /> * isValid(user, action_string, data)<br /> <br /> consider using objects provided by the underlying vm <br /> * for representing resources is policy checks (e.g. Java Permissions) and<br /> * for representing the properties of the invocation context (e.g. the Java AcessControlContext)<br /> <br /> ensure that the policy system can support different policies being enforced for different instances of the<br /> same app.</div>

Monzillo https://wiki.owasp.org/index.php?title=ESAPI_Authentication&diff=48391 2008-12-11T14:56:28Z

<p>Monzillo: /* Possible Enhancements */</p> <hr /> <div>== Feature Overview ==<br /> <br /> TODO<br /> <br /> == Possible Enhancements == <br /> <br /> * Wrap Principal don't extend<br /> <br /> * Work to make compatible with container based authentication<br /> <br /> * Provide a reauthentication API<br /> <br /> * consider mechanisms provided by vm to associate authentication state with the invocation (e.g. Java AccessControlContext including Subject)</div>

Monzillo https://wiki.owasp.org/index.php?title=ESAPI_Authentication&diff=48387 2008-12-11T14:52:07Z

<p>Monzillo: /* Possible Enhancements */</p> <hr /> <div>== Feature Overview ==<br /> <br /> TODO<br /> <br /> == Possible Enhancements == <br /> <br /> * Wrap Principal don't extend<br /> <br /> * Work to make compatible with container based authentication<br /> <br /> * Provide a reauthentication API<br /> <br /> * consider mechanisms provided by vm to associate authentication state invocation context (e.g. Java AccessControlContext including Subject)</div>

Monzillo https://wiki.owasp.org/index.php?title=ESAPI_Framework_Strategy&diff=48381 2008-12-11T14:47:18Z

<p>Monzillo: </p> <hr /> <div>the esapi should<br /> <br /> be defined such that it can be used on behalf of applications by frameworks including containers (unless the nature of the functionality is such that it can only work from the application). another way this was said, is such that the api is compatible with ioc.<br /> <br /> share the representations of authentication state employed by the underlying framework or runtime environment.<br /> <br /> leverage the access control primitives (e.j. Java permissions) employed by the underlying framework or runtime environment<br /> <br /> where the api must be embedded in the app, consider separation of the specification of the logical effect of what must be achieved (in the app) from the details of how it will be accomplished, such that different mechanisms can be bound to achieve the effect, such as the case with Java Annotations.</div>

Monzillo https://wiki.owasp.org/index.php?title=ESAPI_Framework_Strategy&diff=48379 2008-12-11T14:46:02Z

<p>Monzillo: </p> <hr /> <div>the esapi should<br /> <br /> be defined such that it can be used on behalf of applications by frameworks including containers (unless the nature of the functionality is such that it can only work from the application). another way this was said, is such that the api is compatible with ioc.<br /> <br /> share the representations of authentication state employed by the underlying framework or runtime environment.<br /> <br /> leverage the access control primitives (e.j. Java permissions) employed by the underlying framework or runtime environment<br /> <br /> where api must be embedded in app, consider separation of the specification of the logical effect of what must be achived (in the app) from the details of how it will be accomplished, such that different mechanisms can be bound to achieve the effect, such as the case with Java Annotations.</div>

Monzillo https://wiki.owasp.org/index.php?title=ESAPI_Framework_Strategy&diff=48369 2008-12-11T14:40:13Z

<p>Monzillo: New page: the esapi should be defined such that it can be used on behalf of applications by frameworks including containers (unless the nature of the functionality is such that it can only work fro...</p> <hr /> <div>the esapi should<br /> <br /> be defined such that it can be used on behalf of applications by frameworks including containers (unless the nature of the functionality is such that it can only work from the application). another way this was said, is such that the api is compatible with ioc.<br /> <br /> share the representations of authentication state employed by the underlying framework or runtime environment.<br /> <br /> leverage the access control primitives (e.j. Java permissions) employed by the underlying framework or runtime environment</div>

Monzillo