用于“自我”的REST API过滤器

Question

I have a lot of APIs that are to be dual-use, by both an end-user and administrative staff. I will use preferences and give two examples:

• /user/preferences - This give the end-user their preferences
• /users/{user}/preferences - This gives any person's preferences

Clearly this is leading to duplication. Of-course, I can use only '/users/{user}/preferences' for both end-users and administrators, but then I end up with other problems:

1) The person will need to put in their user ID into each call, which is clunky.

2) Security will now become a problem, as the backend needs to ensure that each request is being managed correctly, ie A malicious person cannot put in another person's ID and retrieve their preferences.

What's the best pattern to follow here?

Answer 1

One option is to make the /user/preferences take an optional ?userid= parameter for the admin calls. Then you can use the same endpoint and branch based on admin == true && args[userid] .

The comment on proxy api endpoints is good too where a less specific call ( /user/preferences ) calls a more specific endpoint ( /user/{userid}/preferences ).

Either are good options. A lot of people put all the admin calls under /admin/... and add a handler to verify the caller is actually an admin before routing to the regular calls ( /admin/users/preferences -> verify is_admin -> /users/preferences?userid=bob ).