[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f33mcco9u1riqt":3},{"_id":4,"slug":5,"title":6,"subtitle":7,"kind":8,"cards":9,"tags":23,"categories":25,"source":27,"lang":30,"author":31,"audioState":34,"stats":35,"publishedAt":38,"renderer":39},"6abcc9b4ca21c797c7ea1249","a-batch-api-is-not-a-free-pass-on-every-item-18df66b9","A batch API is not a free pass on every item","Batch and bulk endpoints are convenient: one request, many IDs.","news",[10,13,18],{"headline":6,"body":11,"imageUrl":12,"sourceImageUrl":12},"Batch and bulk endpoints are convenient: one request, many IDs. They are also a classic place where authorization shrinks to \"caller can hit this route.\"","https:\u002F\u002Fmedia2.dev.to\u002Fdynamic\u002Fimage\u002Fwidth=1200,height=627,fit=cover,gravity=auto,format=auto\u002Fhttps%3A%2F%2Fdev-to-uploads.s3.us-east-2.amazonaws.com%2Fuploads%2Farticles%2F4gl6il1puusap7frbz2u.png",{"headline":14,"body":15,"imageUrl":16,"images":17},"If your handler loads ten resources and returns","If your handler loads ten resources and returns whatever the IDs resolve to, a caller who is allowed to see one row can often learn about nine others. The same trap shows up on bulk update, delete, and \"export these records\" paths.","\u002Fapi\u002Fmedia\u002Fposts\u002Fa-batch-api-is-not-a-free-pass-on-every-item-18df66b9\u002F1.webp",{"local":16},{"headline":19,"body":20,"imageUrl":21,"images":22},"Authorize every item in the batch against the","Authorize every item in the batch against the current subject, tenant, and action. Fail closed on any ID the caller must not touch — do not silently skip it and keep returning the rest unless that behavior is an explicit, audited product choice. A route-level role check is necessary. Per-item authorization is what makes a batch API safe. For further actions, you may consider blocking this person and\u002For reporting abuse","\u002Fapi\u002Fmedia\u002Fposts\u002Fa-batch-api-is-not-a-free-pass-on-every-item-18df66b9\u002F2.webp",{"local":21},[24],"dev",[26],"Technology",{"name":28,"url":29},"Dev.to","https:\u002F\u002Fdev.to\u002Fauthbyexample1\u002Fa-batch-api-is-not-a-free-pass-on-every-item-3im6","en",{"handle":32,"displayName":33},"spots","Spots","queued",{"views":36,"likes":37,"saves":37,"shares":37,"completions":37,"opens":37,"skips":37,"depthSum":37},1,0,"2026-09-30T08:35:00.257Z","local"]