I have a database where users have access to a model (called institution), which is designated to them by the admin. In Node.js (using strapi which is a headless cms) I wrote the logic to restrict user access to only the institution model associated with them:

  find: async (ctx) => {
    // this is not finding by ID, but just finding institutions
    const user = ctx.state.user;
    if (!user) {
      return ctx.badRequest(null, [{ messages: [{ id: "No authenticated user found" }] }]);
      const data = await strapi.services.institution.fetchAll({user:user.id});

      return ctx.notFound();


It's all working fine. The admin is the only one who has access to add/remove institutions associated with each user. BUT - how can the frontend do the same thing on transaction with credit card? If the transaction has been completed successfully, how can the frontend of my application send a request to the server to associate an institution with the specific user? In other words, the frontend doesn't have any privileges in the first place. If it had these privileges, the website wouldn't be secured and anyone could do as they wish.

If this is a broad concept, could you please direct me to the relevant names so I can study it? I just don't know where to start.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.