Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Background

I am about to create a website which will have a registration/login area. After the user has logged in he/she will have the ability to buy one or many modules which consist of static content regarding a topic. Of course the security on these modules is important as I want to make sure only people who have bought the package have acccess to the relevent modules.

Problem

Do you think its a good idea to store the information in a session about which user has access to which package once they have logged in so I only make a single call to the database to find out.

OR

I go to the database everytime they access a particular module to make sure they have access to that module

OR

I do both

OR

there is an another way I have completely missed...

Any advice will be great. I am trying to get a balance between performance and security.

Thanks

share|improve this question
    
If such a simple query could come even near to creating a performance problem, you would most likely get far bigger problems in other areas where you need to access serious amounts of data. –  thorsten müller Dec 9 '11 at 9:03
add comment

migrated from programmers.stackexchange.com Dec 9 '11 at 11:34

This question came from our site for professional programmers interested in conceptual questions about software development.

1 Answer

up vote 5 down vote accepted

If you store the information in the session, it might get outdated wrt. to the database. That is, if module ownership expires, or it can be cancelled through other means, it might still be present in someone's session. Whether that's a problem or even a feature, is up to you.

However, this is "premature optimization". Unless you can prove (prove!) that this is going to be a performance problem, I wouldn't spend any more time than strictly necessary on it.

share|improve this answer
    
As alex said spend time on this only if hitting the database would really take you away from your performance benchmark! And if it does you need to consider updating the info in the session if the user prvlgs change because of user actions ( easy bit) and if the user privlg change because of other factors (subscription expired, system changes like rules of subscription change, any batch running on your system etc etc etc.) –  Sachin Kumar Dec 9 '11 at 12:13
    
Thanks guys just needed to be sure =o) –  Bobby Dec 9 '11 at 13:00
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.