Administering the security of a website is an important part of a content manager's job. In fact, as the site becomes more sophisticated and more interactive, security becomes crucial.
Unfortunately, most Web platforms make administering security difficult. First, HTML and graphic files might have their security tied to the operating system, but their user database is off-limits for the content manager. Sometimes the commands used to modify security are quite cryptic and thus too complex for the content manager. Finally, data that is dynamically delivered, for instance by CGI scripts and database logins, introduce a host of new headaches concerning users and permissions.
Site managers also have a hard time being responsive. How much control do I give to the content manager? Will giving the content manager a login unacceptably lower my security? What do I do when the content manager wants a login for his customers? Not only would it be geometrically more work for me, but can I trust these "customer customers" with logins? How much work will be involved in deleting the customer and all the tendrils that have spread throughout my platform?
Zope security was designed to address these content manager and site manager issues. Additionally, the security model leverages the unique features of Zope to mirror unique Web business models.
Previous Chapter | Next Chapter | Up | Next Section | Contents