Are there any best practices for URL routing in a master detail application?

Let's say the master is a list of fruits. And the master can be filtered based on user security (not all users have access to banana, client side filters (only show green fruits), etc.

The URL route for an apple cannot be as simple as /apple, because there is no guarantee that apple is currently in the master list.

Or would it make sense to handle detail items that are not in the master? You could update the master list to ensure that apple is there, or leave the master list as is, without apple.

Or would you handle routing differently than /apple?

closed as primarily opinion-based by GlenH7, Robert Harvey, durron597, user22815, Ixrec May 21 '15 at 0:03

Many good questions generate some degree of opinion based on expert experience, but answers to this question will tend to be almost entirely based on opinions, rather than facts, references, or specific expertise. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I am not sure quite what you are asking. Is your real concern how to integrate access control to a master detail app? – Jay Elston May 15 '15 at 20:08

I would keep your routing as simple as possible - /apple seems perfectly valid.

If the user is not allowed to view /apple then show them an error message, if they are allowed to but apple is currently hidden by filters, I'd remove those filters and show them the apple.

Basically - routes should refer to distinct resources and not be clouded by other concerns.

  • 1
    Yes, a 403 page saying 'You have no access here; we can neither confirm nor deny the existence of apples' would be perfectly fine. Add a helpful link to /fruit with a list of allowed fruit for extra points. – 9000 May 15 '15 at 16:26

What I'd use:

  • /fruit or just / — allows to select a master which the user is allowed to see.
  • /apple, /banana, etc — access a particular master and show available details. If the user is not allowed, responds with a 403.
  • /apple/seed — access to a detail record; again, is access-controlled and give 403 if the user is not allowed to access either a particular detail or a particular master.
  • /anything-else — returns 403 (not 404) to prevent a user from checking which fruits exist and which don't.

Upsides: utter simplicity, easy-to-remember links.

Downsides: need to check for master access on every detail page.

Not the answer you're looking for? Browse other questions tagged or ask your own question.