Skip to main content
Software Engineering

You are not logged in. Your edit will be placed in a queue until it is peer reviewed.

We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.

11
  • Thank you for the reply. Great, so from what you say I guess one way to implement it would be via claims on a JWT access token, so that the resource can detect what kind of user (admin, customer or simply not logged in, etc) and react appropriately returning the desired representation? Commented 2 days ago
  • 1
    @user1620696, yes, exactly that. Commented 2 days ago
  • 2
    404 is not a lie. The server looked in the places the customer is permitted, and did not find the item there Commented 2 days ago
  • 1
    I think the reason why treating securables as first-class addressables is useful, is because it's very much easier to talk about someone "having permission to use both /admin/inventory and /customer/inventory" than it is to talk about "having permission to call /inventory with the ?adminView parameter both being true and being false/missing". (2/2) Commented 2 days ago
  • 1
    @JimmyJames Rather than Cache-Control: no-store you may want to use Vary: Cookie or Vary: Authorization Commented 2 days ago