codez
Traversal based URL routing
A project I am working on now has strong security requirements. Therefore I would like to have a layered approach that provides guard-rails at several levels. In the past I did development with the Python based Zope application server. This server has the notion of traversal.
Traversal is an alternative to pattern based routing. This cuts the URL into path components and then looks up an item from the database. It then uses that to traverse to the second path component and so on until the components all are processed.
The nice thing about this traversal concept is that it allows for authorization checks to be applied during the traversal phase. This can make sure that it would be impossible to access sub-paths if access is denied at a higher level.
I think I can replicate this concept in Phoenix. What I am wondering about is if this makes sense or if there are better options to do this kind of thing. As a concrete example of an URL:
/organizations/mega-corp/projects/secret-X/tools/profitinator/...
This could also be modelled (with traversal) as:
/organizations/mega-corp/secret-X/profitinator/...
I’m fine with either of those, just interested in the security aspect. With traversal (in both versions) it would be possible to limit access to sub-paths of mega-corp to employees. A similar thing can be done when traversing secret-X and so on.
For more background on the traversal mechanism in Python based frameworks:
Most Liked
LostKobrakai
This is not how Plug.Router nor Phoenix.Router work. They’re so fast in matching routes exactly because they harness plain old pattern matching below the hood. This is not to say you cannot get the same level of security from them. With scopes and pipelines you can prevent access in a similar manner. Only the router won’t be able to resume matching if being prevented from access for an previously matched route.
You can also build a custom router. In the end routers are just plugs, which receive a conn and some opts and dispatch to controllers, which also are just plugs (MyController.call(conn, action)). But keep in mind that this will likely mean you cannot use phoenix liveview. It’s deeply integrated with the router level.
Popular in Questions
Other popular topics
Latest Phoenix Threads
Latest on Elixir Forum
Sponsor Spotlight
Build Elixir applications with speed and confidence.
Categories:
Sub Categories:
Forums
Popular Tags
- #ecto
- #liveview
- #troubleshooting
- #learning-elixir
- #deployment
- #library
- #erlang
- #testing
- #genserver
- #mix
- #absinthe
- #remote-other
- #otp
- #plug
- #how-to-question
- #macros
- #postgres
- #channels
- #elixirconf
- #exunit
- #discussion
- #javascript
- #code-sync
- #podcasts
- #onsite
- #dialyzer
- #docker
- #authentication
- #umbrella
- #full-time-contract
- #podcasts-by-brainlid
- #ecto-query
- #elixir-ls
- #phoenix_html
- #iex
- #blog-post
- #graphql
- #genstage
- #ai
- #websockets
- #supervisor
- #advent-of-code
- #elixirconf-us
- #distillery
- #processes
- #forms
- #api
- #metaprogramming
- #security
- #performance
Our Sponsors
Build Elixir applications with speed and confidence.
Supporting innovation across the BEAM ecosystem.
We build reliable cloud platforms for business-critical systems.
Catch errors, track performance, monitor hosts and more.
Real-time error tracking, performance insights, and observability for devs.
Develop your skills with books, videos, and courses.
Enabling companies to succeed by building software people love.
The deployment platform built for Elixir: PaaS ease, VPS control.
Courses that'll move you from confusion to "Aha, now I get it!"