Bureaucrats, editor, reviewer, Administrators
13,554
edits
Changes
Jump to navigation
Jump to search
m
Text replacement - "<syntaxhighlight lang="xquery">" to "<pre lang='xquery'>"
This page presents the web application permission layer of BaseX, which can be used along with [[RESTXQ]].
Non-trivial web applications require a user management: Users need to log in to a web site in order to get access to protected pages; Depending on their status (role, user group, …), they can be offered different views; etc. With {{Version|9.0}} of BaseX, a The light-weight permission layer has been added that simplifies permission checks a lot:
* Permission strings can be attached to RESTXQ functions.
With the {{Code|%perm:allow}} annotation, one or more permission strings can be attached to a RESTXQ function:
<pre classlang="brush:'xquery"'>
(:~ Login page (visible to everyone). :)
declare
** If no path argument is specified, {{Code|/}} is assigned instead.
* A variable can be specified in the second argument. A map with the following keys will be bound to that variable:
** {{Code|allow}}: Permission strings attached to the requested function; may be empty.
** {{Code|path}}: Original path of the client request.
** {{Code|method}}: Method of the client request ({{Code|GET}}, {{Code|POST}}, …).
** {{Code|authorization}}: Value of the HTTP Authorization header string; may be empty.
An example:
<pre classlang="brush:'xquery"'>
import module namespace Session = 'http://basex.org/modules/session';
=Authentication=
There are numerous ways how users can be authenticated in a web application (via OAuth, LDAP, …). The approach demonstrated in on this article page is pretty basic and straightforward:
* A login HTML page allows you to enter your credentials (user nameusername, password).
* A login check function checks if the typed in data matches one of the database users. If the input is valid, a session id will be set, and the user will be redirected to the main page. Otherwise, the redirection points back to the login page.
* A logout page deletes the session id.
The following lines of code complete the image:
<pre classlang="brush:'xquery"'>
declare
%rest:path("/login-check")
=Changelog=
;Version 9.1
* Added: {{Code|authorization}} value in permissions map variable
The Module was introduced with Version 9.0.
