0

Are there any best practices for URL routing in a master detail application?

Let's say the master is a list of fruits. And the master can be filtered based on user security (not all users have access to banana, client side filters (only show green fruits), etc.

The URL route for an apple cannot be as simple as /apple, because there is no guarantee that apple is currently in the master list.

Or would it make sense to handle detail items that are not in the master? You could update the master list to ensure that apple is there, or leave the master list as is, without apple.

Or would you handle routing differently than /apple?

Improve this question
1
  • I am not sure quite what you are asking. Is your real concern how to integrate access control to a master detail app? Commented May 15, 2015 at 20:08

2 Answers 2

Reset to default
3

I would keep your routing as simple as possible - /apple seems perfectly valid.

If the user is not allowed to view /apple then show them an error message, if they are allowed to but apple is currently hidden by filters, I'd remove those filters and show them the apple.

Basically - routes should refer to distinct resources and not be clouded by other concerns.

Improve this answer
1
  • 1
    Yes, a 403 page saying 'You have no access here; we can neither confirm nor deny the existence of apples' would be perfectly fine. Add a helpful link to /fruit with a list of allowed fruit for extra points. Commented May 15, 2015 at 16:26
0

What I'd use:

  • /fruit or just / — allows to select a master which the user is allowed to see.
  • /apple, /banana, etc — access a particular master and show available details. If the user is not allowed, responds with a 403.
  • /apple/seed — access to a detail record; again, is access-controlled and give 403 if the user is not allowed to access either a particular detail or a particular master.
  • /anything-else — returns 403 (not 404) to prevent a user from checking which fruits exist and which don't.

Upsides: utter simplicity, easy-to-remember links.

Downsides: need to check for master access on every detail page.

Improve this answer

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.