3

I've been meaning to add a feature to my application's config files that allow you to blacklist or whitelist certain users. Which one is a better mechanic?

Mechanic 1

Block certain people

{
  "blacklist": [
    "these",
    "users",
    "are",
    "blocked"
  ],
  "whitelist": [
    "these",
    "users",
    "are",
    "always",
    "allowed"
  ]
}

(result: blocked is the only blocked user)

Block all except a few people

{
  "blacklist": [
    "*"
  ],
  "whitelist": [
    "these",
    "users",
    "are",
    "allowed"
  ]
}

(result: these, users, are, allowed are the only allowed users)

Mechanic 2

Block certain people

{
  "blacklist": [
    "these",
    "users",
    "are",
    "blocked"
  ],
  "isWhitelist": false
}

(result: these, users, are, blocked are blocked)

Block all except a few people

{
  "blacklist": [
    "these",
    "users",
    "are",
    "allowed"
  ],
  "isWhitelist": true
}

(result: these, users, are, allowed are the only allowed users)

Which one would work better and feel more intuitive?

Thanks.

1

I would always deny all, then allow "user 1", "user 2", etc.

{
  "blacklist": [
    "*"
  ],
  "whitelist": [
    "user 1",
    "user 2"
  ]
}

Keep it simple. With your other example, you have another flag "isWhitelist" to set on a block of users. It's confusing to see a property blacklist and then "isWhitelist" next to it, which specifies they're allowed. I assume they're blacklisted, because of the property's name, but then they're not because the flag "isWhitelist" allows them. It's misleading.

Look at how MS does this on IIS IP restrictions.

<location path="Default Web Site">
   <system.webServer>
      <security>
         <ipSecurity allowUnlisted="false"><!-- this line blocks everybody, except those listed below -->                
            <clear/> <!-- removes all upstream restrictions -->
            <add ipAddress="192.168.100.1" />
            <add ipAddress="169.254.0.0" subnetMask="255.255.0.0" />
         </ipSecurity>
      </security>
   </system.webServer>
</location>

If you want to protect a directory, you deny all, then allow certain users.It's much easier to read at a glance, and it's less confusing because it's obvious all are blacklisted except the whitelist.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.