Never use assertions for checks production needs

How to do it

Several runtimes strip assertions from production builds. Python removes every assert under the -O flag. Java skips them unless the JVM starts with -ea. PHP skips them when zend.assertions is -1, the setting its production config recommends. An access check written as an assertion then lets every request through. Raise a typed domain exception instead, and refuse access when the check fails, as Deny access when a check fails says.

Examples

Python example

# Bad: under python -O this line is gone, and anyone can refund
def refund(order: Order, user: User) -> None:
    assert user.can_refund(order), "not allowed"
    payments.refund(order)

# Good: the check runs in every build
def refund(order: Order, user: User) -> None:
    if not user.can_refund(order):
        raise RefundNotAllowed(order.id, user.id)
    payments.refund(order)

Java example

// Bad: the JVM skips this line unless it starts with -ea
assert user.canRefund(order) : "not allowed";

// Good: the check runs in every build
if (!user.canRefund(order)) {
    throw new RefundNotAllowed(order.id(), user.id());
}

How to check

A linter fails on assert outside test files. Examples are Ruff and Bandit rule S101 for Python and a grep for assert in PHP and Java source folders. The test suite also passes with Python's -O flag, or with Java assertions off.

Sources

• Python language reference: the assert statement

Related rules

• Use typed domain exceptions in Architecture
• Deny access when a check fails in Security testing