...
Why did we add this security block to the end point instead of a route segment or input entity field?
Requirements Remember, requirements are executed in collections at 3 different levels (endpoint, route, and input fields). In order for a collection to pass at least one requirement in the collection must succeed. The framework always adds the a requirement at the end point level that requires authentication. Also all collections must pass their requirements. Lets assume we are an anonymous user attempting to call the end point.
If we add no additional security metadata all end points will have security that looks like this:
| Collection Name | Requirements |
|---|
- Endpoint - require authentication
- Route - none
- Input fields - none
...
| Result | ||
|---|---|---|
| Endpoint | Require Authentication | Fail |
| Route | None | Pass |
| Input Fields | None | Pass |
The require authentication rule will fail, the end point grouping will fail, and therefore the request will not be allowed to execute.
If we added the security block to the route level we would have:
| Collection Name | Requirements | Result |
|---|---|---|
| Endpoint |
...
| Require Authentication | Fail | |
| Route | Allow Anonymous | Pass |
| Input Fields | None | Pass |
The route grouping would pass, but the end point grouping would still fail so the request would not be allowed to execute. Remember, all collections must pass for the request to proceed.
When we add the security block to the end point level we have:
- Endpoint - require authentication, allow anonymous
- Route - none
- Input fields - none.
...
| Collection Name | Requirements | Result |
|---|---|---|
| Endpoint | Require Authentication, Allow Anonymous | Require Authentication fails but Allow Anonymous passes, so this entire collection passes. |
| Route | None | Pass |
| Input Fields | None | Pass |
All collections pass. This allows the request to proceed and we get the desired result.