I'm currently developing an API (node/express js) for a blog website that uses a markdown parser (showdown
) for rendering content and a html sanitizer (html-santize
) for removing malicious html/js.
Currently I am at the point where I want to let a user edit a post, but I do not want to expose "raw" content to other users other than the creator/owner of the blog-post.
Preferrably I would like to use the same route I use for retrieving raw data (GET /blog/:id?raw=true
) which is harder to secure because they flow through the same controller, while raw=false
would be a open route and raw=true
would be a secured route. I could then fiddle around with some middlewares and stuff, but it all feels kind of hacky and I don't think it's good API design.
The other option I'm considering is implementing a new route (GET /blog/raw/:id
), which would be easy to secure, but I would have 2 get-routes for the same resource in different shapes.
I know there isn't really a correct answer here, but I would like to hear your thoughts on this.
GET /blog/:id
with the raw data. If they do not have a JWT, or they are not the owner/creator, reply toGET /blog/:id
with the processed data.