Update authorization.md for request response clarity #2167
Conversation
Clarified behavior of request responses for non-existent entities and unauthorized access.
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
Here's a supportive code review enhanced by AI assistance. These suggestions offer potential improvements and insights to consider, though they're recommendations rather than requirements. You have full control over which feedback to implement based on your project's specific needs and goals. The AI analysis is here to complement your expertise and help streamline your development process.
Model: claude-sonnet-4-20250514 | Prompt Tokens: 960 | Completion Tokens: 414
|
@sjvans Could you review the AI suggestions? In addition I'd like to collect feedback on the usage of an AI Review. Feel free to sent it my way :) |
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
i'm a satisfied customer! |
| ::: info Avoid enumerable keys | ||
| In case the filter condition is not met in an `UPDATE` or `DELETE` request, the runtime rejects the request (response code 403) even if the user is not even allowed to read the entity. To avoid to disclosure the existence of such entities to unauthorized users, make sure that the key is not efficiently enumerable. | ||
| In case the filter condition is not met in an `UPDATE` or `DELETE` request, the runtime rejects the request with a `404` response if the entity doesn't exist but a `READ` request would succeed if it did. | ||
| Otherwise, the runtime rejects with `403`, so that the response is consistent whether the entity doesn't exist or the user is not allowed to read it (in both cases a `READ` would result in a `404`). |
There was a problem hiding this comment.
What is "Otherwise" meaning here? Filter condition met? Or filter condition not met but a different request?
There was a problem hiding this comment.
| Otherwise, the runtime rejects with `403`, so that the response is consistent whether the entity doesn't exist or the user is not allowed to read it (in both cases a `READ` would result in a `404`). | |
| For all other requests, if the filter condition is not met, the runtime rejects with `403`, so that the response is consistent whether the entity doesn't exist or the user is not allowed to read it (in both cases a `READ` would result in a `404`). |
Clarified behavior of request responses for non-existent entities and unauthorized access.