Let's say I'm making a platform like Linkedin. The platform let you upload your business detail.

All public visitors can go to your business page and view public information such as name and description. But, if you are the owner, you can also see additional private information such as your Sales figure, Invitations, etc on that same page

To do that, I make a route which gets the detail of a particular business (GET /businesses/:id)

This API has a authorization middleware that, for example, check whether you have a valid JWT to prove your identity.

If the JWT is incorrect or absent, the API only fetches and returns public information of that business. However, if the JWT is correct, it fetches additional information including all public and private detail of that business.

So, my question is, how serious are the disadvantages of using the same API route with conditional authorization? (maintainability/testability/security?)

Do I need to separate this into two different routes?

  • 1
    Isn't every major API already doing that? E.g. I can choose which information to share when authorizing an app in $SocialNetworkName. Apr 21 at 15:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.