Fine-grained access handling and data management with row-level security — Smashing Magazine

Many applications have some kind of user-specific information or data that is supposed to be accessed by a certain group of users and not by others. With these kinds of requirements comes a demand for fine-grained access handling. Whether for security or privacy reasons, handling sensitive data is an important topic for any application. Big or small, no one wants to be on the wrong side of a data breach scandal. So let’s dive into what it means to handle sensitive or confidential information in our applications.

Take it seriously

Whether you’re requesting access on Twitter, a bank or your local library, identifying yourself is an important first step. Any kind of gateway need a reliable way to verify that an access request is legitimate.

“Identity theft is no joke.”
— Dwight Schrute

On the web, we encompass the process of identifying a user and granting them access as Authwhich stand for two related but separate actions:

• Authentication: the act of confirming a user’s identity.
• Authorization: grants an authenticated user access to a resource.

It is possible to have authentication without authorization, but not the other way around. The strategy to...