Hi, when we write a middleware for authorization checks, I assume while doing these validation checks, we should only be concerned about the object name that is coming from the request path right?
We shouldn't be bothered about the details that is coming in the request body or the details that we need to extract from the service database using the object name?
Is this how the industry follow?
Example:
Assume if we have an api say where we add authors for a book, POST /v1/books/{book_name}/authors and we are putting authorization checks on book name
For validation checks, we should only consider the object name which is book name. We shouldn't even check the book details by querying in the database or even check the request body for other details right?
