Hacker News Reader

I tell everyone the same thing about access control. Don't check access.

Also, never check file existence.

These things just take up time, introduce race conditions, and can't be trusted anyway.

That said, there are reasons to want to check some things with UI-level validation because calls to a slow back end are slow. Thus the name. I get that.

So if you're doing UI validation, don't get it right. Just get it mostly right. And do it fast. Cheat!

View on HN

> I tell everyone the same thing about access control. Don't check access.

This caught my eye and I’m dying to know more - could you elaborate or point me to a good resource on this? My team has been dealing with some issues related to this recently.

It may be in reference to TOCTOU. [0] If you check that you can access a resource before you access that resource, you have implemented a race condition where you could potentially lose access to the resource in between the check and access attempt. It's probably not an issue if you have proper error handling, but it seems common to check that access is allowed then assume the resource will still be accessible later, without handling errors for when it's not.

[0] https://en.wikipedia.org/wiki/Time-of-check_to_time-of-use

Thank you so much for sharing this!

Reply on news.ycombinator.com