Parameter by payload than by URL

[actionhero]

Parameter by payload than by URL

[evantahler]

I think you asked this same question on stack overflow, so here's my answer again:

---

Regardless of your language/framework, all routes are able to be hit by anyone, unless you block them at load-balancer or similar level.

Rather than thinking about the problem as "how to block" access, you should be thinking about the problem like "how can I ensure that this user is authenticated to use this route". Using things like cookies or tokens is the way to go.

You can use actionhero's middleware to apply access rules to specific actions, and return errors to the use if they aren't allowed.

Here's an example project that does these types of things:

• Actions for dealing with the session: https://github.com/evantahler/actionhero-angular-bootstrap-cors-csrf/blob/master/actions/session.js
• Middleware which uses that session data for access: https://github.com/evantahler/actionhero-angular-bootstrap-cors-csrf/blob/master/initializers/session.js
• and finally another action (route/url) which requires the logged-in-session middleware: https://github.com/evantahler/actionhero-angular-bootstrap-cors-csrf/blob/master/actions/showDocumentation.js

[hzahoori]

Thanks for the answer!
I know you can authenticate a user to have access to an api, I have already implemented that part with tokenization, but what I am wondering is just like you do a get request and you pass the parameters by url?id=12, I should not able able to do that in post request? means it should only go by a payload not a url. like in ajax you say data:data, if you ca please answer me on that part? it would be great!! Thanks

[evantahler]

Ah!

It seems like you are asking for a feature to disable URL parameters for specific routes (It is valid to provide ? params in a POST, and it is a topic of debate which method (payload vs params) has priority.

Open an issue on the main actionhero project asking for this feature, and describing in detail (with examples) what you would like to be able to do

[hzahoori]

Thanks evan, that is right.
I will create an issue regarding it.