Skip to content

Role in client route authorization #423

@ghost

Description

I think it would be useful to have "authorization:admin" or "authorization:user" inside the client routes. Otherwise a user could see the admin interface of a page which doesn't call an API (thus returning the 401 error). It is true that the HTML interface should contain no secrets, but I think it is better not to allow the routing to an admin page to a simple user.

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions