Security Restrict Global Restriction on API actions

[Apple]

Yes, that’s the way I do it too! High five

I use $_SERVER.PATH_INFO instead of $_SERVER.URL, and I use the .startsWith formatter rather than .contains. I suggest you do the same

Set Value pathinfo = {{ $_SERVER.PATH_INFO }}
Condition {{ pathinfo.startsWith("/api/admin") }}

I actually use an array to store the paths that need to be restricted, and then I use a Repeat step to iterate on each array element (each path that needs to be restricted) and check if it matches the current path

Also, see my initial discussion regarding this matter here:

Do we really need to Server Restrict every single Server Action we want to protect?

Do we really need to apply server restrict to each server action we want to protect? e.g.: /admin/user/delete Wouldn’t it be better to just apply the server restrict to a group of routes? e.g. /admin Am I missing something? It feels like Wappler didn’t nail this right yet. In other frameworks we have middlewares, so we can apply common logic to a group of routes instead of manually going to every possible page/server action we want to protect Manually protecting every single Server Action is …