Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Effective ACL Resource discovery requires 2n+1 requests

Open
  • Is something wrong?
#99 28 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Stale
Domain
authorization

Research direction

Read the Effective Access Control Resource Discovery Use Case linked in the issue, then compare the four WAC+ approaches described there. Review issue #248 for the preferred alternative. Done would require an agreed approach for reducing discovery to one request, but the issue does not identify an implementation file or test.

Written by the indexing model from the issue text.

Description

The Access Control Panel has been putting together protocol comparisons between WAC, ACP, and various WAC+ solutions. (WAC+ are potential ways of extending WAC in a backward compatible way).

The Effective Access Control Resource Discovery Use Case reveals a quite dramatic problem for WAC when a resource is using a default rule further up the hierarchy. We have 4 WAC+ ways to solve the problem listed in the document there. Please could the WAC community help us select one of them?

Problem description

Our resources are set up as follows:

</default.acr>
</foo/bar/baz/x>
</foo/bar/baz/x.acr>
  1. The client makes a request on </foo/bar/baz/x> and receives a response —
401 Credentials Required
Link: </foo/bar/baz/x.acr>; rel="acl"
Link: <.>; rev="http://www.w3.org/ns/ldp#contains"
...

The server needs to link to the closest possible ACR for the resource, to allow a client with Control rights to know what ACR to edit if it wants the rules there to apply specifically to that resource. If the resource were to link directly to the default, the client would not know where to overwrite the default.

  1. The client makes a request to the ACR </foo/bar/baz/x.acr> but receives the reponse —
404 Not Found

— as the resource does not yet exist.

  1. First the client is lucky enough to be shown the reverse ldp:contains relation in the response in (1) above, so it can do a HEAD on that to find its ACL.
HEAD /foo/bar/baz/ HTTP/1.1

— and with luck the server will respond —

200 Ok
Link: </foo/bar/baz/.acr>; rel="acl"
Link: </foo/bar/>; rev="http://www.w3.org/ns/ldp#contains"
  1. The client can then continue with —
GET /foo/bar/baz/.acr HTTP/1.1

— to which the server will also return —

404 Not Found

— as the resource does not yet exist.

  1. As a result, the client will need to look up one level in the hierarchy to search for the effective ACR:
HEAD /foo/bar/ HTTP/1.1

— and with luck the server will respond —

200 Ok
Link: </foo/bar/.acr>; rel="acl"
Link: </foo/>; rev="http://www.w3.org/ns/ldp#contains"
  1. The client can then continue with —
GET /foo/bar/.acr HTTP/1.1

— to which the server will also return —

404 Not Found

— as the resource does not yet exist.

  1. As a result, the client will need to look up one level in the hierarchy to search for the effective ACR:
HEAD /foo/ HTTP/1.1

— and with luck the server will respond —

200 Ok
Link: </foo/.acr>; rel="acl"
Link: </>; rev="http://www.w3.org/ns/ldp#contains"
  1. The client can then continue with —
GET /foo/.acr HTTP/1.1

— to which the server will also return —

404 Not Found

— as the resource does not yet exist.

  1. As a result, the client will need to look up one level in the hierarchy to search for the effective ACR:
HEAD / HTTP/1.1

— and with luck the server will respond —

200 Ok
Link: </.acr>; rel="acl"
  1. The client can then continue with —
GET /.acr HTTP/1.1

— to which the server will finally return the content.

The number of requests needed to find the default can be calculated by the formula —

reqN = 2 * slashes + extraFile

— where —

  • slashes is the number of slashes between the original resource and the effective ACR
  • extraFile is 0 if the resource is an ldp:Container and 1 if it is a plain resource

So in our example above we have reqN = 2 * 4 + 1 = 9.

What we want is for that number to be cut down to 1 request.
As I mentioned there are 3 or 4 answers.
The one I prefer, as it is the simplest is explained in define another relation for non-created ACR.

Dominant language
HTML
Stars
131
Forks
29
No merged PRs in 30d

Getting set up

This project ships no dev container, Dockerfile or contributing guide, so setting up is up to you: start from its README, and see our first-contribution guide for the general steps.

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from solid/web-access-control-spec

All issues in solid/web-access-control-spec

Similar issues

More Security issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.