FOUNDATIONUnder review

Security

Distinguishes identity, permission, validation and auditing.

SecurityAdvPL

01 · OVERVIEW

Overview

Authentication verifies identity; authorization decides whether that identity may act on a resource. In Protheus consider company, branch and environment rights alongside module rules. Hiding a button does not secure REST calls or automatic routines. Deny by default and authorize at execution boundaries, validating input and avoiding sensitive error disclosures. This exercise only demonstrates a negative Boolean decision; it is not access-control implementation and reads no user directory. (Sources: refs. 1–3.)

03 · PRACTICAL EXAMPLE

Commented example

#Include "Protheus.ch"

User Function Ed644()
    // Synthetic decision: use real policy, never hardcoded .T.
    Local lAllowed := .F.
    If lAllowed
        ConOut("AUTHORIZED")
    Else
        ConOut("DENIED")
    EndIf
Return Nil

Expected result

Prints DENIED in this exercise; invokes no protected operation. Under review: editorial example neither compiled nor run in Protheus. Check includes, release, RDD and context before testing.

BEST PRACTICES

Test allowed/denied cases, including other branches/resources. A user ID or profile is not proof of permission.
Under review: editorial example neither compiled nor run in Protheus. Check includes, release, RDD and context before testing.

Security

Overview

Commented example

Related content

Comments