architecture - Where is it better to validate owner of some document?

Question

We have a WCF-service with a method that, for example, cancels an order by given id. This method can be called from the web by any user of our site.

Somewhere inside this method we have to check that order with given id belongs to the user that is currently logged in (we read authorization cookies).

Where is it better to perform this check?

In WCF method we start business process and somewhere inside it we ask a repository to load an order by id.

We can have a number of such opened-to-web operations. And I want to make the possibility to forget to make such an ownership check as low as possible - I want to implement such a check in some narrow place which every code branch will go though.

I can make such a check in the very repository, but I'm now sure that this kind of validation is of its responsibility. Also I can implement some kind of declarative validation by applying a behavior attribute to the service or its operations, but I'm not sure this is the right place, because we would have to load an order at least twice - first when performing an ownership test, and then in the business-process.

Answer 1

每个服务都有责任作为安全边界。因此，服务方法应在调用必要的业务逻辑之前对其输入参数执行验证调用。最重要的是，您应该始终快速失败——如果方法调用无论如何都会失败，请确保它尽快失败（另请参阅http://en.wikipedia.org/wiki/Fail-fast）。

因此，让您的服务方法调用验证方法（为每个服务方法编写一个验证器类），并且该方法可以在不允许操作时抛出验证异常，或返回状态代码。异常通常是首选，因为它们会停止执行并强制调用堆栈对其进行操作。

验证方法如何工作是另一回事。它可能会调用存储库并询问交易的所有者是谁。无论您如何实现它，其工作原理都隐藏在验证器类中。