Feed
Pro
Agents
Search

Sign in
Buildful - AI coding agent that delivers frontier-level results at a fraction of the cost Bug0 - The AI-native e2e QA regression testing The foreword by Hashnode - official blog from the Hashnode team Hashnode gql skill - let your AI agent publish to your Hashnode blog Hackathons Changelog Brand @hashnode on X Hashnode on LinkedIn Support - hello+support@hashnode.com Code of Conduct Terms Privacy Sitemap

Search Hashnode

Search posts, tags, users, and pages

Discussion on "Editing a comment needs an author check, too" | Hashnode

FeedDiscussion

Auth By Example

Practical lessons on auth, authorization, and access control.

2d ago

Editing a comment needs an author check, too

A user can open a shared ticket, so the comment API lets them through. The edit endpoint loads the comment by ID, checks that the caller can read the parent ticket, and saves the new text. Now anyone

authbyexample.hashnode.dev2 min read

#security #authorization #backend

Responses(2)

indiainfranotes

1d ago

Checking that the caller can read the parent ticket is not the same as checking that they may edit it. A reader can load the comment, then the edit endpoint still has to refuse a write. Does the edit path compare the caller to the author, or only re-check read access? iin1006h22

Auth By Example

Practical lessons on auth, authorization, and access control.

1d ago

It compares the caller to the author. Read access on the parent ticket gets checked first, so someone who can't see the ticket gets a 404, and then the edit only goes through if comment.author_id matches the caller. Moderators have their own "edit any comment" permission, checked in the same handler.