Hi everyone,
In an attempt to solve a security issue, I've questioned myself if "Caching is based on a User Session or SessionId?". I've not been able to find any documentation that clarifies that.
Let me give some context! I've been asked to guarantee Fine-grain access control (FGAC) on the cached data. We have FGAC enabled by sending the JWT token when integrating with our external databases and want to cache that data on OutSystems. If the caching is based on the session Id, nothing else needs to be done. If not we need to implement the logic on OS side.
Looking forward to hearing your answers. Thanks in advance.
Regards,
Giuliano
Hi Giuliano Ragusa ,
Cache and user session are 2 completely different concepts. The first main difference between session and caching is: a session is per-user based but caching is not per-user based.
Answer to your question is NO, cache is not user session based as it saves the data at application level.
Hi Siddharth,
Thank for replying. I'm aware that the cache is not same as session.
My question is how does the application stores the cache and check if the data is cached? I know it's a RAM based, but I was wondering if perhaps the way it's stored in the RAM would have a reference to a SessionId or something similar to ensure that a different user doesn't have access to someone else's data as our FGAC is on the external database. Because if it does, we could avoid the redundant authorization check in OS.
You can refer this tutorial by outsystems, it's a detailed notes may help you to understand Caching in details,
https://success.outsystems.com/documentation/11/developing_an_application/use_data/caching/
Thanks
Deep
That doesn't mention how the cache is stored in the Frontend server, thus not clearing my doubts.
What I've been thinking could be an easy solution is to add the UserId(using the logged UserId) as an input parameter of the server action that integrates with the external database. This would guarantee that UserB can't access UserA cached data without needing to add any logic to guarantee the authorization.
I would still like to understand how the cache is store inside the RAM at the frontend server level, to make sure I'm not adding redundancy.