Authorization
Enforce function-level authorization
Protect administrative, export, billing, and maintenance operations with explicit server-side permissions on every route and method.
8 minute lesson
Changing a path or HTTP method must not turn an ordinary user into an administrator. Routes need explicit operation-level rules.
Centralize policy where it stays visible, but verify coverage route by route. Deny by default. Test sibling endpoints, alternate methods, batch actions, and older API versions with a low-privilege identity.
The UI hides /admin/refunds, but an ordinary user can still send the request. A new POST route can also escape a policy that only covered the older DELETE method.
Include route aliases and versioned endpoints in the matrix. Central policy helps, but a route-level coverage test proves each handler actually invokes the decision before starting work.
Build a role-by-method matrix for refund, export, and maintenance routes. Run every denied cell with a low-privilege token and save evidence that no side effect or audit gap remains.
Lesson completed