In the previous chapter—where we started upgrading our console application to a web application—we added Create, Read, Update, and Delete (CRUD) operations, which are available publicly to any user who is able to perform them. There is nothing coded to restrict a particular user from performing these operations. The risk with this is that users who are not supposed to perform these operations can easily do so. The consequences of this are as follows:
- Unattended access
- An open door for hackers/attackers
- Data leakage issues
Now, if we are keen to safeguard our application and restrict the operations to permitted users only, then we have to implement a design that only allows these users to perform operations. There may be scenarios in which we could allow open access for a few operations. In our case, most operations are only for...