Hands-On Software Engineering with Golang

Controlling access to API endpoints

After defining the endpoints for referring to resources, the next logical step is to implement a mechanism for enforcing access control. For instance, while /orders/123 and orders/789 are both valid resource paths, they might belong to different users; obviously, we would expect that each user should only be able to access their own orders.

In a different scenario, a user might be able to list the users that belong to a particular security group by performing a GET request to /security-groups/123/users, but only an administrator would be allowed to add or remove users from that group (for example, by performing POST and DELETE requests to the same endpoint). A fairly common pattern for achieving this kind ...