Only Admins Allowed: How to Lock Down Your REST API with Roles

“If a viewer can delete an admin’s resource — that’s not a bug, it’s a huge security vulnerability.”