What is "declarative security"? In general

Question

The answer to this question: http://stackoverflow.com/questions/1210609 Doesn't really tell me much... doesn't tell me anything at all to be blunt.

I came across a blog about performance in .NET and it mentioned this:

Do You Use Declarative Security?

Where possible, it is recommended that you use declarative security instead of imperative security checks. The current implementation of demand provides better performance and support with the security tools that are currently being built to help security audits.

Note that if your security checks are conditional within a method, imperative security is your only option.

Link: http://weblogs.asp.net/sanjeevagarwal/archive/2009/09/09/net-code-performance-tips-part-1.aspx

What does "declarative security" stand for? Can someone give a concrete example?

Answer 1

In general, it's security based on annotating instead of coding. For example, in .NET you can apply an attribute to a method that causes the generated code to require the caller to have certain rights.

Here's a concrete example: http://www.knowdotnet.com/articles/securityattributes.html

Answer 2

Declarative features allow the programmer to express intentions at design time. These intentions are enforced internally by the language's engine — in other words, we don't see how it's done. An example would be attributes:

[RequireDeletePermission]
public void DeleteFile( string fileName )
{
}

This declaration states that the DeleteFile method cannot be called without the DeletePermission. (This is a made-up example.) The runtime will enforce this rule for you. No more code is required. SQL permissions also fit into this category.

Policies that you enforce using your own code are called imperative. You can use any language mechanism to accomplish this, but the code itself (as opposed to a built-in construct) expresses your intention. You'll see this kind of thing in SQL triggers, when no formal constraint captures the exact restriction that is required.

CREATE TRIGGER TR_UPD_fix_image_filename ON products AFTER UPDATE
AS
BEGIN
    UPDATE product SET image=itemnumber + '.jpg' WHERE id IN (SELECT id FROM inserted)
END

(Okay, so it's a dumb example. By design, most typical cases can be handled by constraints.)

Answer 3

You can look at AOP examples.

In general, declarative implies a code organization when code implementing security is detached from the other code (from business logic e.g.). Usually all security artifacts concentrated in one place, and that simplifies development of both components: business logic and security.