- The most obvious: I have one more file to modify if I change or add some controller.
- This reveals the URL of all the existing controllers to anyone that reads the code of the page.
- I have to do the same security checks in every controller.
I imagined the following scenario... what if, after authentication, I only had one controller that checks if the requested functionality is available for the connected user, and only then calls the right code (controller? simple class?) and return the result of this code. This code would never be accessible from outside, only internally.
Am I just confused with MVC and the SPA pattern?