I'm currently developing an API (node/express js) for a blog website that uses a markdown parser (
showdown) for rendering content and a html sanitizer (
html-santize) for removing malicious html/js.
Currently I am at the point where I want to let a user edit a post, but I do not want to expose "raw" content to other users other than the creator/owner of the blog-post.
Preferrably I would like to use the same route I use for retrieving raw data (
GET /blog/:id?raw=true) which is harder to secure because they flow through the same controller, while
raw=false would be a open route and
raw=true would be a secured route. I could then fiddle around with some middlewares and stuff, but it all feels kind of hacky and I don't think it's good API design.
The other option I'm considering is implementing a new route (
GET /blog/raw/:id), which would be easy to secure, but I would have 2 get-routes for the same resource in different shapes.
I know there isn't really a correct answer here, but I would like to hear your thoughts on this.