MSAMM
Back to course

Oracle Visual Builder: Applications That Outlive Their First Release · Module 11 · Security: who sees what

Roles inside your application

Lesson 113 of 176 · 3 min

Who may OPEN WHICH PAGE and PRESS WHICH BUTTON, and the fact that this is NAVIGATION CONVENIENCE RATHER THAN A CONTROL. Application roles are useful and are not what most people assume they are, and the distinction is the whole lesson. WHAT THEY DO IS SHAPE THE INTERFACE. A menu without the pages this person cannot use, a screen without the button they may not press, a section that is not there for them. That is genuinely valuable — an interface offering things that will be refused is a worse interface, and it is what Module 3 Lesson 7's findability argument asks for. WHAT THEY DO NOT DO IS STOP ANYTHING. The page is still there at its URL, the button's action chain still exists, and the endpoint underneath is unchanged. A role check in the browser is code the user controls, deciding whether to show them something they were…

The full lesson is part of the course

The video, the complete written lesson and the module quiz are included in Oracle Visual Builder: Applications That Outlive Their First Release, with a certificate on completion and a fourteen-day refund window.

See the course and enrol9 free lessons

Get the free lessons by email

We will email you a link to every free lesson in this course. No account needed, and one message only.

In this module: Module 11 · Security: who sees what

  1. 1Where the trust boundary is
  2. 2Filtering in the UI is not securityFree preview
  3. 3Hiding a field sends it anyway
  4. 4Filter at the source
  5. 5Identity propagation, properly
  6. 6Roles inside your application
  7. 7Securing business object endpoints
  8. 8Secrets do not go in an application
  9. 9What ends up in a log or a URL
  10. 10What breaks: four security findings
  11. 11Lab briefing · Attack your own application