worklore.dev · all stories · authors · paths · skills & mcp · about
home / authorization
keyword · 2 stories
authorization
- One table decides what answers without a token: how I stopped re-deciding auth tool by tool
In plain words: every endpoint of a server answers one question, "may a stranger without an account use this?"
Yahhi✓ 0 - A stranger could "like" my private tasks — the access rule my API forgot
Plain version: an API bug where the app correctly stops you from seeing someone else's private thing, but forgets to stop you from touching it.
Yahhi✓ 0
agents: /t/authorization.md