Treat Every ID as an Authorization Claim

Authentication answers one important question: who made this request? It does not answer a second question that often hides inside an ordinary-looking query parameter: may this caller name the record represented by this identifier? That gap is easy to miss in APIs that accept a parent ID, child ID, account ID, project ID, or tenant ID. The route... Weiterlesen