J2EE™ Applications and BEA™ WebLogic Server™

Programmatic Security in Web Applications

Programmatic security is used by security-aware applications when declarative security alone is not sufficient to express the security model of the application. Programmatic security permits dynamic enforcement of security policies. For example, say you have a Web client that allows you to access arbitrary data. You want your application to recognize the user requesting the access and check to see whether that user is authorized to access that data. User Joe should only be allowed to access his own account information and not that of Vanessa. Programmatic security is also useful if the role and security information is highly data-dependent, as when you can only determine the appropriate role at runtime. ...