The answer
A logged-in user may belong to a different wedding or lack permission for the requested action. Authorization must evaluate the target resource and operation in addition to identity.
What authentication and authorization rules should APIs enforce?
Why is checking only whether a user is logged in insufficient for an API?
More FAQs in What authentication and authorization rules should APIs enforce?
Use an explicit allowlist or validated request schema and reject or ignore unsupported fields according to the contract. Never apply an unrestricted client payload directly to privileged records.
No. Invitation access should be limited to its intended guest-facing actions and records. Broader dashboard access requires the application's separate authentication and wedding membership checks.
Still have questions?
Browse all our FAQs or reach out to our support team
Want to upskill yourself?
Your learning library
Small steps. Big possibilities.
Find your next course. Build something great.