This is a potential confused deputy problem:
http://en.wikipedia.org/wiki/Confused_deputy_problem.

I know it's not RESTy but the "security"-first approach to this problem is
to eliminate any chance of confusion, which mean that the thing that
authenticates the user is the thing that also identifies the user. If you
asked warner, he would say no user id in the URLs. :)


On Sun, Feb 24, 2013 at 10:38 PM, Ryan Kelly <notifications@github.com>wrote:

> In routes/syncstore.js:
>
> > +    }
> > +    request.reply(info);
> > +  });
> > +}
> > +
> > +
> > +// Handler function for getting the items in a collection.
> > +//
> > +// This fetches the while list of items from the syncstore backend, filters
> > +// then based on the "ids" and/or "newer" query parameters, and returns the
> > +// filtered list to the client.
> > +//
> > +// XXX TODO: X-Last-Modified header
> > +//
> > +function getItems(request) {
> > +  var userid = request.params.userid;
>
> IMHO the right thing for the view to do is take userid from the request
> params. It's serving a particular resource and that resource is identified
> by the request URL, not the session. Ideally the auth check would be
> factored out of this method and put into a prereq or some other part of the
> view configuration.
>
> —
> Reply to this email directly or view it on GitHub<https://github.com/mozilla/picl-server/pull/26/files#r3131145>.
>
>