3 ms·
Thanks, this is thought-provoking. I went and did some reading—-am I mistaken for thinking simply disabling introspection in production is a hard counter to thi
by twodave 4y ago
Thanks, this is thought-provoking. I went and did some reading—-am I mistaken for thinking simply disabling introspection in production is a hard counter to this? I realize for a public API (or API product) that isn’t super helpful, but for my own use cases nobody on production needs it.
Other than that, it seems that the answer is just performing object-level authorization to ensure you never leak resources a user isn’t supposed to have access to. Depending on the framework you use this can be pretty straightforward…
- marcosdumay 4y agoYes, if your data is not entirely public, you will need object-level autorization. But the point is that no, it's not straightforward; the authorization must be designed to fit your needs. If you are not designing it, you can be certain that it's broken.
- twodave 4y agoThanks for taking the time to explain. You’ve helped me revise my opinion (yes, some folks are willing to receive new information and change haha).