我应该将用户 ID 放在 REST url 中还是从身份验证中获取

Question

I'm building a RESTful api with Express.js. Let's say I have some Users which own Resources . A good way to get the Resources of a specific User would be: GET /users/:user_id/resources .

I implemented authentication for the api and can thus get the user_id from req.user.user_id instead of from the url. This means I could just use GET /resources to get the resources from the authenticated user.

My question: is this good practice and why (or why not)?

Answer 1

I think, it is bad practice. Resources should return all resources, not filtered in any way. I would say it is better to have an additional endpoint /user/resources . In this way responses will be:

1. /users/15/resources - will give resources for user 15 if allowed or 403.
2. /user/resources - will give resources for the authenticated user (if I am user 15, then this gives the same response as in 1.) OR 404 OR 403.
3. /resources - will give not filtered resources (if it is prohibited, then just don't create this endpoint, or return only public resources).