lumpidu/redis — Issue #3: Client authorized with fine grained authorization may not make changes to other authorization tokens
Author: lumpidu
Created: 2011-12-11 13:02:23+00:00
State: open

This one is harder, as it means quite a change to the whole easy authorization mode.

It's easy to detect changes to the key with which the actual client is authorized and forbid any commands on it, but how should one know, if just any other set is an authorization set ?

For this to function properly, one has to add a special marker to an authorization set and prevent any changes to these sets. This means an additional lookup for each possible operation that could modify a set.