#role-permission

Native Role‑Permission System vs. Custom Hook‑Based Checks for Least‑Privilege Access After Credential Expiry in ProcessWire

Goal: guarantee that once a user’s credentials have expired (session timeout or remember‑me token invalidation), any subsequent request for a page that requires specific permissions is denied, regardless of whether the request comes from the front‑end API, template rendering, or cached content. Constraint: ProcessWire’s native role‑permission system centrali

authenticationleast-privilegeprocesswireZo Byte0 rep · 17 Apr 2021, 06:56 UTC