Security Restrict Global Restriction on API actions

[datguru]

Hey everyone just a quick question. I was trying to think of a quicker and easier way (and hopefully more foolproof way) to ensure that all the actions that need protecting are protected. Rather than having to add the security restrict to each api workflow each time.

What I have done is added a Condition in the Global.Json which does a condition to see if the $server.url contains the path I am looking for. It will then run my security Restrict. Is this the best way to do this or is there a better way to do that please?

Thanks for reading!

[Apple]

Yes, that’s the way I do it too! High five

I use $_SERVER.PATH_INFO instead of $_SERVER.URL, and I use the .startsWith formatter rather than .contains. I suggest you do the same

Set Value pathinfo = {{ $_SERVER.PATH_INFO }}
Condition {{ pathinfo.startsWith("/api/admin") }}

I actually use an array to store the paths that need to be restricted, and then I use a Repeat step to iterate on each array element (each path that needs to be restricted) and check if it matches the current path

Also, see my initial discussion regarding this matter here:

Do we really need to Server Restrict every single Server Action we want to protect?

Do we really need to apply server restrict to each server action we want to protect? e.g.: /admin/user/delete Wouldn’t it be better to just apply the server restrict to a group of routes? e.g. /admin Am I missing something? It feels like Wappler didn’t nail this right yet. In other frameworks we have middlewares, so we can apply common logic to a group of routes instead of manually going to every possible page/server action we want to protect Manually protecting every single Server Action is …

[datguru]

Thanks Apple, seems like an improvement on my logic thanks . Glad I was on the right track at least.