且构网

分享程序员开发的那些事...
且构网 - 分享程序员编程开发的那些事

防弹使用ACL AngularJS

更新时间:2023-12-05 15:14:04

隐藏部分的角方法是使用 NG-IF / NG-显示/ NG隐藏指令,如:

The Angular way of hiding sections is with the ng-if/ng-show/ng-hide directives, as in:

<div ng-if="is_admin">...</div>

您不能隐藏的人谁看源代码,或者你在你的应用程序提供的资源这些div。所以不提供管理数据,这些看法。

You can't hide those divs from people who look at the source, or the resources you make available in your app. So don't provide admin data to those views.

我的做法是使一个admin的应用程序,除了他们之间的标准应用程序和链接。通过这种方式,暴露的唯一的东西是链接到管理网站,这被***,以非管理员用户:

My approach was to make an "admin" app in addition to the "standard" app and link between them. This way, the only things exposed are links to the admin site, which are blocked to non-admin users:

<div ng-if="is_admin"><a href="/admin/#/link">Link</a></div>

所有请求我的 /管理/ * 页面返回401状态code,如果他们不是管理员。剩下的资源也会返回401状态codeS为宜。

All requests to my /admin/* pages return a 401 status code if they are not an admin. The REST resources also return 401 status codes as appropriate.

(编辑:以上改变纳克隐藏 NG-如果共进晚餐preSS在这些div所得的DOM。)

( changed above ng-hide to ng-if to suppress those divs in the resulting DOM.)