Does a hidden organizer button protect the underlying operation?
No. A caller can send requests without using that button. The server must independently verify identity, resource membership, and permission before reading or changing protected data.
Explore This Question
Search for additional explanations using these tools:
More FAQs in How should authentication and authorization be represented in the architecture?
Membership often belongs to a particular wedding. A person may organize their own wedding and collaborate on another, so permission checks must consider the target wedding.
Review access after membership removal, cross-wedding resource identifiers, restricted fields, and guest invitation scope. These examples reveal gaps that a successful organizer login does not exercise.
Still have questions?
Browse all our FAQs or reach out to our support team