[WW-4118] Allow RolesInterceptor to validate role names

• Type: Improvement
• Status: Closed
• Priority: Minor
• Resolution: Fixed
• Fix Version/s: 2.3.16
• Flags: Patch
• Assignee: Lukasz Lenart
• Reporter: Cam Morris
• Created: 19/Jun/13 16:12
• Updated: 08/Dec/13 17:21
• Resolved: 18/Oct/13 08:36

Description

Role names can be easily misconfigured resulting in security holes. However app developers typically known which roles are available in their environment. A small tweak to RolesInterceptor could make it easy for developers to have role verification. When the roles are invalid the RolesInterceptor could fail-fast, quickly bringing the issue to attention.

Issue Links

• is related to: WW-4117 RolesInterceptor ignores disallowedRoles when allowedRoles are configured