ACR Rules

⌘K
  1. Home
  2. Docs
  3. ACR Rules
  4. Security (28)
  5. Anonymous users should only be allowed to create non-persistent entities

Anonymous users should only be allowed to create non-persistent entities

Released in version 1.6 (03 March 2020)

Otherwise, a malicious agent could create millions of objects causing the database to run out of space. Note that XPath constraints are not applied when creating new objects.

Non-compliant example:

*assuming that AnonymousUserModuleRole is a module role that is related to the project role for anonymous users in the app.

Compliant example:

No create access or the entity should be non-persistable.