Re: Accept on GET and access control

hello john.

On 2014-01-16, 20:32 , "John Arwe" <johnarwe@us.ibm.com> wrote:
>It's still valuable, for all the reasons
>you point out.  Clients simply have a higher "probability"
>(p=1.0) of receiving that hint from an LDP-compliant HTTP server.

just adding to that from our implementation experience: determining access
rights can be a rather expensive operation, because it's based on
authenticated identity, roles, and rather complicated role-based access
models for resources. so for us, computing all access rights to all linked
resources would result in very bad UX, because it would take a lot of time
to complete, and the vast majority of accesses to those linked resources
are browsing (i.e., read) only. so what we have is a way for clients to
selectively request this kind of information, because clients know better
what they might need. forcing servers to always compute something that
might be expensive to compute and is not needed in probably >>99% of cases
is not something we would be willing to do, for our specific environment.

cheers,

dret.

Received on Thursday, 16 January 2014 21:01:00 UTC