Is there a way to dynamically/programmatically sec...

# javalin

[Robert Jaros]

Is there a way to dynamically/programmatically secure an existing endpoint (defined earlier without any roles)?

[arthur]

Not sure. Why can't you use roles?

[Robert Jaros]

Just experimenting with some integration code

[Robert Jaros]

But I've already found a way to use roles, so the answer is no longer relevant :-)

[sbyrne]

Roles are not flexible enough for my situation, so I do authz right at the beginning of each handler and throw io.javalin.http.ForbiddenResponse. I see no downside to doing authz in my application code.

[david-wg2]

@sbyrne that’s essentially what the access manager does too (it wraps handlers) - could you explain why the role system isn’t flexible enough?

[sbyrne]

The authz decision depends on the request content.

[david-wg2]

the access manager has access to the full request context

[david-wg2]

(i’m @tipsy btw, this is my work account)

[sbyrne]

Then I would have to buffer the whole request in memory. They are often too large to do that.

[david-wg2]

aha

[sbyrne]

I do use roles in some of my endpoints. They work fine for most cases. But if you want to do authz in the handler, Javalin stays out of your way and helpfully provides ForbiddenResponse.

[david-wg2]

that sounds like a corner case, but feel free to make an issue if you think it can be solved in a generic way

[sbyrne]

"Makes the easy thing easy and stays out of your way if you want to do the hard thing yourself" is my favorite feature of frameworks.