Presently, RIP accepts the definition of an authorize function per service. This is not granular enough, as some services may allow public access to read-only methods like GET while requiring the enforcement of stricter authorization for methods like POST or PUT.
We should keep the service-wide authorize function as fallback, but allow also the definition of custom authorization functions for particular methods.
Presently, RIP accepts the definition of an
authorizefunction per service. This is not granular enough, as some services may allow public access to read-only methods like GET while requiring the enforcement of stricter authorization for methods like POST or PUT.We should keep the service-wide
authorizefunction as fallback, but allow also the definition of custom authorization functions for particular methods.