System Design Concepts · API Design
Authorization: a route check is not an object check
A role check at the route is needed but not enough. The most common API breach is never asking whether this user owns object 123.
In interviews · 3 questions
Related Questions
- 01
- 02
- 03