# Query-Based Security (QBS)

(formerly known as Timisoara Ticket Definition)
Nowadays the majority of web tools provide security per resource, i.e. the object to be secured is some sort of a directory in the site.
It seems to be mathematically possible to compute the credentials needed based on the queries used in a page rather than based on the page path! For example given a type (MDD), it should be possible to write Query Fragment Methods that define access rights to the CRUD (create-read-update-delete) operations on the respective type and on related types. Instead of being defined near the page/folder, the query based security (QBS) would be defined somewhere near the data types (model)
Query analysis for QBS should be done at page (or whatever other module) analysis. It should only be done once. Its results should be query fragments to execute (appended to other queries or separately)
Brief:

- try to imagine how the query-based-security would look like for several concrete examples of security constraints in an existing application
- consider the overhead that the checking of QBS credentials will add
- consider whether such security credentials, once obtained, can be stored in a session
- instead of blocking access to the whole page, it may be possible to add some QBS qurery fragments to a given query and filter out the results that the principal does not have the right to see!
- the framework should also allow for hiding parts of a page if some QBS for only that part of the page fails.
- look into security theories
- look into the mathematics of query analysis for QBS