1

I have built a custom webapi endpoind with which a customer can get details of their personalised item.

    <route url="/V1/personalizations/get/:personalizationId" method="GET">
        <service class="Me\MyPersonalization\Api\PersonalizationRepositoryInterface" method="get"/>
        <resources>
            <resource ref="self"/>
        </resources>
    </route>

This works great and I can retrieve individual Personalization Objects.

The problem is however, anyone can retrieve anyone elses row as there is no logic to check if the logged in user owns the row.

I can easily do something in the get() method to check....

if ($this->customerSession->getCustomerId() !== $personalization->getCustomerId()) {
    throw new LocalizedException(__("You are not allowed to do this"));
}

But I would need to repeat the logic for every method.

What is the correct way to do custom authentication on webapi?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.