# Managing roles and access control in a web application

DevFeed: [Managing roles and access control in a web application](<https://devfeed.tech/articles/managing-roles-and-access-control-in-a-web-application-20000.md>)

Original publisher: [Read original article](<http://engineering.hackerearth.com/2016/01/29/managing-roles-and-access-control/>)

Published: 2016-01-29T00:00:00Z

Content type: article

Language: en

Sources: [HackerEarth](<https://devfeed.tech/sources/hackerearth.md>)

Topics: [Access Control](<https://devfeed.tech/topics/access-control.md>), [Authorization](<https://devfeed.tech/topics/authorization.md>), [web applications](<https://devfeed.tech/topics/web-applications.md>), [Django](<https://devfeed.tech/topics/django.md>), [Python](<https://devfeed.tech/topics/python.md>), [Code](<https://devfeed.tech/topics/code.md>), [Filesystems](<https://devfeed.tech/topics/filesystems.md>), [Networks](<https://devfeed.tech/topics/networks.md>)

Tags: [access-control](<https://devfeed.tech/tags/access-control.md>), [applications](<https://devfeed.tech/tags/applications.md>), [code](<https://devfeed.tech/tags/code.md>), [django](<https://devfeed.tech/tags/django.md>), [files](<https://devfeed.tech/tags/files.md>), [filesystem](<https://devfeed.tech/tags/filesystem.md>), [networking](<https://devfeed.tech/tags/networking.md>), [networks](<https://devfeed.tech/tags/networks.md>), [processes](<https://devfeed.tech/tags/processes.md>), [python](<https://devfeed.tech/tags/python.md>), [web](<https://devfeed.tech/tags/web.md>)

## AI overview

This article explains how HackerEarth Recruit implements role-based access control for administrators in a Django application. It introduces access control lists (ACLs), maps roles and privileges to application features, and uses decorators to restrict view access.

## Source excerpt

HackerEarth Recruit, is a platform for technical recruitment. Many companies use this platform for candidate assessments and interviewing. There can be multiple admins for a company account. As teams grow in size, access control is a special concern for applications that deal with financial and privacy data. Access control is concerned with determining the allowed activities of legitimate users, but we required more sophisticated and complex control mediating every attempt by a user to access a resource in the application based on the sensitivity level of various features. A state of access control is said to be safe if no permission can be leaked to an unauthorized or uninvited principal. We figured that the simpliest solution to restrict access was to use ACL. What is ACL ? An access control list (ACL), with respect to a computer file system, is a list of permissions attached to an object. An ACL specifies which users or system processes are granted access to objects, as well as what operations are allowed on given objects. Many kinds of systems implement ACL, or have a historical implementation like Filesystem ACLs and Networking ACLs. A filesystem ACL is a data structure (usually a table) containing entries that specify individual user or group rights to specific system objects such as programs, processes, or files. In Networking ACL refers to rules that are applied to port numbers or IP addresses that are available on a host or other layer 3, each with a list of hosts and/or networks permitted to use the service. For Recruit, the approach had to be role based access restriction to authorized admins. This implementation of access control mechanism is defined around roles and privileges. Implementation (Python/Django) Access control Lists can be configured to map roles to features. In this ACL implementation, roles are named after existing features which require access control. Each access right should have a unique name, and also assign a unique value to each. T