something he shouldn't delete?
You can use 409 Conflict
Set delete button to Visible/Enable = false, so no action can be performed when user has no rights to do it.
User might send post request themselves via curl
return CONFLICT status is a bad practice; users need to see only what their profile/role enables them to do/see, nothing more. Don't add useless and messy functions on the controller, return only OK or ERROR (fisical error); all filters data type must be applied before data be transfered to the controller.
So we should allow users to do whatever they want with curl?
do users are so "advanced" that they can send something with params on URL?
I work at hosting provider so yeah
403
420
Is it because he doesn't have the permission?
Not ready to fake action.
Обсуждают сегодня